CVE-2024-23059

TOTOLINK A3300R version V17.0.0cu.557_B20221024 contains a command injection vulnerability in the setDdnsCfg function, exploitable via the username parameter. The root cause is improper filtering of command-related characters in that parameter, enabling arbitrary command execution. CVSS 3.1 base ...