CVE-2024-28640

Deeper analysis

CVE-2024-28640 is a buffer overflow vulnerability, tracked under CWE-125 as an out-of-bounds read, that affects the TOTOLINK X5000R router running firmware V9.1.0u.6118-B20201102 and the A7000R router running V9.1.0u.6115-B20201022. The flaw resides in handling of the command field and carries a CVSS 3.1 base score of 7.5, reflecting network-accessible exploitation with no required credentials or user interaction that results in high impact to availability.

An unauthenticated remote attacker can send a crafted command value to the affected devices, triggering the overflow and causing a denial-of-service condition that disrupts router operation. No authentication or local access is needed, allowing exploitation from anywhere on the network path to the device’s management interface.

Public references point to GitHub repositories documenting the TOTOLINK issues, but they contain no vendor advisory, firmware patch, or mitigation guidance. The EPSS score currently stands at 0.1705 with a recorded peak of 0.1742, indicating moderate and relatively stable exploitation interest since disclosure.