CVE-2023-24140

Deeper analysis

TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command injection vulnerability in the setNetworkDiag function, where the NetDiagPingNum parameter is passed directly to a system command without sanitization. The flaw is tracked as CVE-2023-24140 and is assigned CWE-77 along with a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation that requires no authentication or user interaction.

An unauthenticated remote attacker can supply a crafted NetDiagPingNum value to execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the affected PoE access point, enabling actions such as configuration changes, traffic interception, or use of the device as an entry point into the attached network.

The EPSS score for this CVE rose from a low baseline after public disclosure to a peak of 0.3113 on 2025-01-22 before receding to the current value of 0.1490, indicating a measurable increase in observed exploitation interest well after the original publication date. Public proof-of-concept code demonstrating the injection has been posted to GitHub, but no vendor advisory or firmware patch information is referenced in available sources.