CVE-2024-0293
Published: 08 January 2024
Summary
CVE-2024-0293 is a medium-severity OS Command Injection (CWE-78) vulnerability in Totolink Lr1200Gb Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 13.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical OS command injection vulnerability exists in the Totolink LR1200GB router firmware version 9.1.0u.6619_B20230130. The flaw resides in the setUploadSetting function of /cgi-bin/cstecgi.cgi, where unsanitized input to the FileName argument allows arbitrary command execution. It is tracked as CVE-2024-0293 with CWE-78 and carries a CVSS 3.1 score of 6.3.
An authenticated remote attacker can supply a crafted FileName value to the affected CGI endpoint and execute operating-system commands on the device. Public exploit code has been released, enabling attackers to achieve limited confidentiality, integrity, and availability impacts without user interaction.
No vendor patch or mitigation guidance has been issued; the manufacturer did not respond to disclosure. The associated EPSS score rose from a low baseline to a peak of 0.0656 on 2025-01-22 before receding, indicating increased exploitation interest well after the January 2024 publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16089
Vulnerability details
A vulnerability classified as critical was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this vulnerability is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack can be launched remotely.…
more
The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249859. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.