by Kastro
Paper/Archive/CVE-2024-52723

CVE-2024-52723

totolink x6000r_firmware — In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering.

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.4.634 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
x6000r_firmware9.4.0cu.1041_b20240224–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgist.github.com/M4rg4tr01d/e84f8ed8dc27960d7c56ad289f6fb0ff