CVE-2023-24146
Published: 03 February 2023
Summary
CVE-2023-24146 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink Ca300-Poe Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command injection vulnerability in the setRebootScheCfg function, where the minute parameter is not properly sanitized before being passed to a system command. The flaw is tracked as CVE-2023-24146, carries a CVSS 3.1 base score of 9.8, and is classified under CWE-77.
An unauthenticated attacker with network access can supply a crafted minute value to execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker full control over the router, including the ability to read, modify, or delete data and to disrupt device operation.
Public proof-of-concept code demonstrating the injection has been published on GitHub. The EPSS score for the CVE rose from low values after disclosure to a peak of 0.3113 on 2025-01-22 before receding to the current 0.1490, indicating a measurable increase in observed exploitation interest well after the initial publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28209
Vulnerability details
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.