CVE-2024-34204

Deeper analysis

TOTOLINK outdoor CPE CP450 version 4.1.0cu.747_B20191224 contains a command injection vulnerability in the setUpgradeFW function that is triggered through the FileName parameter. The flaw, tracked as CWE-77, stems from inadequate sanitization of user-supplied input and carries a CVSS 3.1 score of 9.8 reflecting network-accessible, unauthenticated exploitation with full confidentiality, integrity, and availability impact.

An attacker with network reachability can submit a crafted FileName value to the affected endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants complete control over the CPE, enabling actions such as configuration changes, malware deployment, or lateral movement within the attached network.

Public references consist of proof-of-concept disclosures hosted on GitHub that demonstrate the injection vector but contain no vendor advisory, firmware update, or mitigation guidance.

The associated EPSS score has stayed low, moving only from 0.0497 to a brief peak of 0.0598 before receding, with no indication of material exploitation activity following disclosure.