CVE-2023-24238
Published: 16 February 2023
Summary
CVE-2023-24238 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A7100Ru Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-24238 is a command injection vulnerability (CWE-77) affecting the TOTOlink A7100RU router running firmware version V7.4cu.2313_B20191024. The flaw resides in the city parameter processed by the setting/delStaticDhcpRules endpoint and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated remote attacker can supply a crafted city value to execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, enabling actions such as configuration changes, traffic interception, or use of the device as an attack pivot.
The associated EPSS score rose from a low baseline to a peak of 0.3113 on 2025-01-22 before receding to the current value of 0.0516, indicating a clear post-disclosure increase in observed exploitation interest. Public references consist of proof-of-concept material hosted on GitHub that demonstrates the injection vector.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28296
Vulnerability details
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.