CVE-2023-24156
Published: 03 February 2023
Summary
CVE-2023-24156 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink T8 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-24156 is a command injection vulnerability in the ip parameter of the recvSlaveUpgstatus function within TOTOLINK T8 firmware version 4.1.5cu. The issue, tracked under CWE-77, allows arbitrary commands to be executed when the device processes a crafted MQTT packet.
The flaw is remotely exploitable by unauthenticated attackers over the network without user interaction. With a CVSS 3.1 score of 9.8, successful exploitation grants complete control over the affected device, resulting in full impacts to confidentiality, integrity, and availability.
The EPSS score has remained flat at 0.1638 with no material rise after disclosure. Public references consist of technical proof-of-concept details hosted on GitHub but contain no vendor advisories or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28219
Vulnerability details
A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.