CVE-2023-24276
Published: 06 February 2023
Summary
CVE-2023-24276 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A7100Ru Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOlink A7100RU routers running firmware version V7.4cu.2313_B20191024 contain a command injection vulnerability in the setting/delStaticDhcpRules endpoint. The flaw is triggered through the country parameter and is tracked as CWE-77. It received a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction.
An unauthenticated remote attacker can supply a malicious country value to execute arbitrary operating-system commands on the device. Successful exploitation grants full control over the router, allowing arbitrary code execution with impacts to confidentiality, integrity, and availability.
EPSS for the CVE started low after the February 2023 disclosure, rose materially to a peak of 0.3113 on 2025-01-22, and has since receded to 0.0516, indicating a period of heightened exploitation interest well after public release. Public references consist of proof-of-concept material hosted on GitHub but contain no vendor advisory or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28333
Vulnerability details
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.