CVE-2023-24139

Deeper analysis

TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command injection vulnerability in the setNetworkDiag function, where the NetDiagHost parameter is processed without adequate sanitization. The flaw is tracked as CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction.

An unauthenticated attacker can supply a crafted NetDiagHost value over the network to inject and execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker full control over the affected PoE access point, including the ability to read or modify configuration data, pivot within attached networks, or install persistent malware.

Public proof-of-concept code detailing the injection vector has been published in GitHub repositories, but no vendor advisory or firmware patch addressing the issue appears among the available references. The associated EPSS score rose from a low baseline to a peak of 0.3113 in January 2025 before receding to its current value of 0.1490, indicating a period of heightened exploitation interest after disclosure.