CVE-2023-24153
Published: 03 February 2023
Summary
CVE-2023-24153 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink T8 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-24153 is a command injection vulnerability (CWE-77) affecting the TOTOLINK T8 router running firmware version V4.1.5cu. The flaw resides in the version parameter processed by the recvSlaveCloudCheckStatus function, which fails to sanitize input received over MQTT and permits arbitrary operating-system commands to be executed.
An unauthenticated attacker with network access can exploit the issue by sending a crafted MQTT packet, resulting in full compromise of confidentiality, integrity, and availability as reflected in the CVSS 9.8 score. No authentication, user interaction, or special privileges are required.
Public proof-of-concept material is available in the referenced GitHub repository, but no vendor advisory or firmware patch information is included in the supplied references. The associated EPSS score has remained flat at 0.0597 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28216
Vulnerability details
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.