CVE Feed

    Dashboard / CVE / CVE-2024-2353

    CVE-2024-2353

    A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

    Published:Mar 10, 2024
    Last Modified:Dec 16, 2024
    EPS:Mar 10, 2024
    EPSS Score:0.1232
    CVSS Score:8.8

    Affected Products

    Vendor
    Totolink
    Product
    X6000r
    Vendor
    Totolink
    Product
    X6000r Firmware

    Exploits

    https://github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.mdhttps://github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.md

    Related CVEs

    CVE-2026-4611 (CVSS 8.6) — A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue…
    CVE-2025-70328 (CVSS 8.8) — TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost …
    CVE-2026-1723 (CVSS 9.2) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-11005 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52907 (CVSS 7.3) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This is…
    CVE-2025-52906 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52905 (CVSS 7) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through …
    CVE-2025-52053 (CVSS 9.8) — TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D…
    CVE-2025-52284 (CVSS 6.5) — Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184…
    CVE-2025-25524 (CVSS 5.1) — Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length veri…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High