CVE-2023-24236
Published: 16 February 2023
Summary
CVE-2023-24236 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A7100Ru Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOlink A7100RU routers running firmware version V7.4cu.2313_B20191024 contain a command injection vulnerability in the setting/delStaticDhcpRules endpoint. The flaw is triggered through the province parameter and is tracked as CWE-77, carrying a CVSS 3.1 score of 9.8 that reflects network-accessible exploitation without authentication or user interaction.
An unauthenticated attacker with network reachability can supply crafted input to the affected parameter and execute arbitrary commands on the device, resulting in full control over confidentiality, integrity, and availability of the router.
Public references consist of GitHub repositories that document the issue but contain no vendor advisories or patch guidance. The associated EPSS score rose from a low baseline to a peak of 0.3113 on 2025-01-22 before receding to its current value of 0.0519, indicating a period of increased exploitation interest well after the original disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28294
Vulnerability details
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.