CVE-2023-24157
Published: 03 February 2023
Summary
CVE-2023-24157 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink T8 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-24157 is a command injection vulnerability in the serverIp parameter of the updateWifiInfo function within TOTOLINK T8 firmware version V4.1.5cu. The issue stems from insufficient sanitization of input received via MQTT packets and is tracked under CWE-77, resulting in a CVSS 3.1 score of 9.8.
An unauthenticated remote attacker can exploit the flaw by transmitting a crafted MQTT packet to the affected device. Successful exploitation allows arbitrary command execution on the router, providing full control over confidentiality, integrity, and availability without requiring user interaction or credentials.
Public proof-of-concept code demonstrating the attack has been published on GitHub. The EPSS score remains flat at 0.1638 with no material rise from its recorded peak.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28220
Vulnerability details
A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.