CVE-2024-52723
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
In the TOTOLINK X6000R router running firmware version V9.4.0cu.1041_B20240224, the Uci_Set_Str function in the shttpd file is used without strict parameter filtering. An attacker can achieve arbitrary command execution by crafting a malicious payload.
Risk Assessment
The risk involves potential remote code execution by an unauthenticated attacker, which could compromise the confidentiality and integrity of data within the local network.
Recommendation
It is recommended to immediately update the TOTOLINK X6000R firmware to the latest available version that addresses this vulnerability. If no update is available, restrict management interface access to trusted networks only.
Other vulnerabilities in TOTOLINK X6000R
See all- CVE-2026-1723Critical
OS Command Injection vulnerability in TOTOLINK X6000R. The issue affects versions up to V9.4.0cu.1498_B20250826. An attacker can exploit this vulnerability to execute arbitrary system commands.
- CVE-2023-50651Critical
A remote command execution (RCE) vulnerability was discovered in the TOTOLINK X6000R router running firmware version v9.4.0cu.852_B20230719, specifically in the /cgi-bin/cstecgi.cgi component. An attacker can send a crafted request to execute arbitrary commands on the device.
Original NVD description (English source)
In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.