CVE-2023-24152
Published: 03 February 2023
Summary
CVE-2023-24152 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink T8 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-24152 is a command injection vulnerability affecting the TOTOLINK T8 router running firmware version V4.1.5cu. The flaw resides in the serverIp parameter of the meshSlaveUpdate function and is triggered when the device processes a specially crafted MQTT packet, allowing arbitrary command execution on the underlying system.
An unauthenticated attacker with network access can exploit the issue by sending a malicious MQTT packet to the device. Successful exploitation grants the attacker full control over the router, enabling arbitrary command execution with impacts on confidentiality, integrity, and availability.
The two provided references point to a public technical write-up and proof-of-concept on GitHub but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained flat at 0.0784 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28215
Vulnerability details
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.