CVE-2023-24161
Published: 14 February 2023
Summary
CVE-2023-24161 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink Ca300-Poe Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK CA300-PoE firmware version V6.2c.884 contains a command injection vulnerability in the setWebWlanIdx function triggered by the webWlanIdx parameter. The flaw is tracked as CWE-77 and rated 9.8 under CVSS 3.1, reflecting that it is reachable over the network without credentials or user interaction and can impact confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply a malicious webWlanIdx value in an HTTP request to the device, causing the web interface to execute arbitrary operating-system commands. Successful exploitation yields full control of the affected access point, enabling data exfiltration, configuration changes, or denial of service.
Public details and proof-of-concept material appear in repositories that document the parameter handling flaw, but no vendor advisory or firmware update is referenced in the available sources. The associated EPSS score stands at 0.1490 with no material increase from an earlier lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28224
Vulnerability details
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.