Cyber Posture

CVE-2024-57036

HighPublic PoC

Published: 21 January 2025

Published
21 January 2025
Modified
29 April 2025
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0007 20.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2024-57036 is a command insertion vulnerability (CWE-77) in the TOTOLINK A810R router firmware version V4.1.2cu.5032_B20200407. The issue exists in the main function of the downloadFile.cgi script, which allows an attacker to execute arbitrary commands by sending a specially crafted HTTP request. Published on 2025-01-21, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its network accessibility and potential for significant impact.

A remote attacker with low privileges (PR:L), such as an authenticated user, can exploit the vulnerability over the network with low attack complexity and no user interaction. By sending a malicious HTTP request to downloadFile.cgi, the attacker achieves arbitrary command execution on the device, resulting in high impacts to confidentiality and integrity, while availability remains unaffected.

The primary reference for this vulnerability is available at https://github.com/luckysmallbird/Totolink-A810R-Vulnerability-1/blob/main/3.md, which provides additional details relevant to practitioners.

Details

CWE(s)
CWE-77

Affected Products

totolink
a810r firmware
4.1.2cu.5032_b20200407

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Command insertion in downloadFile.cgi enables exploitation of public-facing web application (T1190) for arbitrary Unix shell command execution (T1059.004) on the router.

References