CVE-2023-24138

Deeper analysis

TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command injection vulnerability in the NTPSyncWithHost function, where unsanitized input to the host_time parameter is passed directly to a system command. The flaw is tracked as CVE-2023-24138 and carries a CVSS 3.1 base score of 9.8, reflecting network-reachable unauthenticated access that can result in full compromise of confidentiality, integrity, and availability. The issue is classified under CWE-77.

An attacker with network access to the device can supply a malicious host_time value that executes arbitrary operating-system commands without authentication or user interaction. Successful exploitation grants the attacker the ability to run code with the privileges of the web-server process, enabling device takeover, configuration changes, or use of the router as an attack pivot.

The EPSS score for this CVE rose from a low baseline after disclosure to a peak of 0.3113 on 2025-01-22 before receding to the current value of 0.1490; this trajectory indicates that exploitation interest increased well after the initial publication. Public references consist of technical write-ups and proof-of-concept material hosted on GitHub that demonstrate the injection vector but do not reference vendor patches or official mitigation guidance.