CVE-2024-35397

HighCVSS 8.8

Published: 28/05/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

15.79%

96th percentile - higher than 96% of all known CVEs

Summary

A command injection vulnerability was discovered in the TOTOLINK CP900L device running firmware version v4.1.5cu.798_B20221228, specifically in the NTPSyncWithHost function via the hostTime parameter. This allows an attacker to execute arbitrary commands through a crafted request.

Risk Assessment

The risk involves potential full remote control of the device by an attacker, leading to network compromise, data theft, or use of the device in DDoS attacks.

Recommendation

Immediately update the TOTOLINK CP900L firmware to the latest available version that patches this vulnerability. If no update is available, restrict device access to trusted networks and apply firewall rules to block unauthorized requests.

Original NVD description (English source)

TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.