CVE-2023-24143

Deeper analysis

TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command-injection vulnerability (CWE-77) in the setNetworkDiag function, where the NetDiagTracertHop parameter is passed to the system without adequate sanitization. The flaw received a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required authentication or user interaction.

An unauthenticated remote attacker can supply a crafted NetDiagTracertHop value that results in arbitrary command execution on the device. Successful exploitation grants the attacker the ability to read, modify, or delete data and to fully compromise the confidentiality, integrity, and availability of the affected PoE access point.

Public proof-of-concept code demonstrating the injection was published on GitHub shortly after disclosure. The associated EPSS score rose from a low baseline to a peak of 0.3113 on 22 January 2025 before receding to its current value of 0.1490, indicating a measurable increase in observed exploitation interest well after the original publication date.