CVE-2024-2353

🗓️ 10 Mar 2024 07:31:04Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 78 Views🌐 WEB

Vulnerability in Totolink X6000R 9.4.0cu.852_20230719 allows remote os command injection

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for Command Injection in Totolink A3700R_Firmware	10 Aug 202313:15	–	githubexploit
Circl	CVE-2024-2353	10 Mar 202409:26	–	circl
CNNVD	TOTOLINK X6000R 操作系统命令注入漏洞	10 Mar 202400:00	–	cnnvd
CNVD	TOTOLINK X6000R Operating System Command Injection Vulnerability	12 Mar 202400:00	–	cnvd
Cvelist	CVE-2024-2353 Totolink X6000R shttpd cstecgi.cgi setDiagnosisCfg os command injection	10 Mar 202407:31	–	cvelist
EUVD	EUVD-2024-27306	10 Mar 202407:31	–	euvd
NVD	CVE-2024-2353	10 Mar 202408:15	–	nvd
OSV	CVE-2024-2353	10 Mar 202408:15	–	osv
Prion	Command injection	10 Mar 202408:15	–	prion
Positive Technologies	PT-2024-2010 · Totolink · Totolink X6000R	9 Mar 202400:00	–	ptsecurity

NVD

Node

totolink x6000r_firmwareMatch9.4.0cu.852_b20230719

AND

totolink x6000rMatch-

[
  {
    "vendor": "Totolink",
    "product": "X6000R",
    "versions": [
      {
        "version": "9.4.0cu.852_20230719",
        "status": "affected"
      }
    ],
    "modules": [
      "shttpd"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
ip	query param	/cgi-bin/cstecgi.cgi	OS command injection via manipulation of the ip parameter in setDiagnosisCfg	CWE-78

16 Dec 2024 22:57Current

9High risk

Vulners AI Score9

CVSS 3.18.8

CVSS 29

CVSS 38.8

EPSS0.06265

SSVC