CVE-2024-35401

MediumCVSS 5.9

Published: 28/05/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

A command injection vulnerability was discovered in TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228 in the UploadFirmwareFile function via the FileName parameter. An attacker can remotely execute arbitrary system commands.

Risk Assessment

The risk for the organization includes potential full device compromise, leading to network integrity breaches, data theft, or using the device as an entry point for further attacks.

Recommendation

Immediately update the TOTOLINK CP900L firmware to the latest available version if a patch is released. In the meantime, restrict management interface access to trusted networks only.

Original NVD description (English source)

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.