CVE-2023-24159
Published: 14 February 2023
Summary
CVE-2023-24159 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink Ca300-Poe Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command injection vulnerability (CWE-77) in the setPasswordCfg function, specifically through the admpass parameter. The flaw received a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation without authentication or user interaction and full impact on confidentiality, integrity, and availability.
An unauthenticated attacker can supply a crafted admpass value to the affected function over the network, resulting in arbitrary command execution on the device and complete system compromise.
The two referenced GitHub disclosures document the vulnerability and proof-of-concept details but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score rose from a low baseline to a peak of 0.3113 on 2025-01-22 before receding to its current value of 0.1490, indicating a clear post-disclosure increase in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28222
Vulnerability details
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.