CVE-2024-57238

CVE-2024-57238 is a SQL injection vulnerability (CWE-89) affecting the Prolink 4G LTE Mobile Wi-Fi DL-7203E running firmware version V4.0.0B05. The flaw resides in the /reqproc/proc_get endpoint, where the order_by parameter fails to properly sanitize user input, allowing attackers to inject malicious SQL code and manipulate underlying database queries. Published on 2025-02-03, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), classifying it as high severity due to its network accessibility and ease of exploitation.

An unauthenticated attacker with network access to the device can exploit this vulnerability remotely with low complexity and no user interaction required. By crafting payloads for the order_by parameter, they can alter SQL queries, potentially leading to unauthorized data access, modification, or limited denial of service, though impacts on confidentiality, integrity, and availability are rated low.

Mitigation details are available in the referenced advisory at https://harryha.substack.com/p/4g-lte-mobile-wifi-dl7203e-sqli-cve-2024-57238 and the product page at https://prolink2u.com/products/dl-7203e-b. Security practitioners should consult these sources for any vendor guidance on patches or workarounds, as no specific remediation is detailed in the CVE description.