CVE-2023-24148
Published: 03 February 2023
Summary
CVE-2023-24148 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink Ca300-Poe Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK CA300-PoE V6.2c.884 contains a command injection vulnerability in the setUploadUserData function, where the FileName parameter is not properly sanitized. The flaw is tracked as CVE-2023-24148 with a CVSS 3.1 score of 9.8 and is classified under CWE-77. It affects the web management interface of this PoE access point firmware version.
An unauthenticated attacker can send a crafted HTTP request over the network to the device and execute arbitrary operating system commands. Successful exploitation grants full control over the device, allowing reading or modifying sensitive data, altering device behavior, or causing denial of service.
The EPSS score for this CVE rose from a low baseline to a peak of 0.3113 on 2025-01-22 before receding to the current value of 0.1490, indicating a clear increase in observed exploitation interest well after the original disclosure. Public references consist of technical write-ups and proof-of-concept material hosted on GitHub, but no vendor advisory or patch information is included in the supplied references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28211
Vulnerability details
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.