CVE-2023-24160

Deeper analysis

TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command-injection flaw in the setPasswordCfg function, where the admuser parameter is passed to the system without adequate sanitization. The issue is tracked as CVE-2023-24160, carries a CVSS 3.1 score of 9.8, and is classified under CWE-77.

An unauthenticated attacker with network access can supply a crafted admuser value that results in arbitrary command execution on the device. Successful exploitation grants the attacker full control over the router, including the ability to read or modify configuration data, install persistent malware, or pivot into attached networks.

Public records of the vulnerability first appeared on GitHub in early 2023. The EPSS score remained low for an extended period before rising sharply to a peak of 0.3113 on 22 January 2025 and later settling at 0.1490, indicating renewed exploitation interest well after initial disclosure. No vendor advisory or firmware update addressing the flaw is referenced in the available sources.