CVE-2024-0298
Published: 08 January 2024
Summary
CVE-2024-0298 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink N200Re Firmware. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as critical exists in the Totolink N200RE router running firmware 9.3.5u.6139_B20201216. It resides in the setDiagnosisCfg function within /cgi-bin/cstecgi.cgi, where improper handling of the ip argument permits OS command injection. The issue is tracked as CVE-2024-0298 with CWE-78 and carries a CVSS 3.1 base score of 7.3.
Remote unauthenticated attackers can supply a crafted ip value to the CGI endpoint and execute arbitrary operating-system commands. Successful exploitation yields limited effects on confidentiality, integrity, and availability. A working exploit has been made public, and the vendor did not respond to early disclosure notification.
The associated EPSS probability rose from a low starting value to a peak of 0.0656 on 2025-01-22 before receding to the current 0.0207, indicating that exploitation interest increased well after the initial publication. No official patches or mitigation guidance appear in the referenced sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-16094
Vulnerability details
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249864. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.