CVE-2024-42745

2024-08-1200:00:00

mitre

github.com

totolink x5000r

os command injection

setupnpcfg

authenticated attackers

arbitrary commands

EPSS

0.001

Percentile

48.2%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:h:totolink:x5000r:-:*:*:*:*:*:*:*"
    ],
    "vendor": "totolink",
    "product": "x5000r",
    "versions": [
      {
        "status": "affected",
        "version": "v9.1.0cu.2350_b20230313"
      }
    ],
    "defaultStatus": "unknown"
  }
]