CVE-2024-34205
Published: 14 May 2024
Summary
CVE-2024-34205 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink Cp450 Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK CP450 version 4.1.0cu.747_B20191224 contains a command injection vulnerability, tracked as CVE-2024-34205 and assigned CWE-78, that resides in the download_firmware function. The flaw carries a CVSS 3.1 base score of 7.3 and is reachable over the network without authentication or user interaction, allowing an attacker to supply crafted input that results in limited impacts to confidentiality, integrity, and availability.
An unauthenticated remote attacker can invoke the affected function to inject and execute arbitrary operating-system commands on the device. Successful exploitation grants the ability to read or modify limited data and disrupt device operation, all without requiring prior credentials or local access.
Public references consist solely of proof-of-concept repositories that demonstrate the injection vector; they contain no vendor advisory, firmware update, or mitigation guidance. The associated EPSS score rose from a low baseline to a peak of 0.0617 on 2025-12-11 before receding to its current value of 0.0467, indicating a measurable increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34685
Vulnerability details
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the download_firmware function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in the download_firmware web function enables exploitation of a public-facing application on a network device (T1190) and remote command execution via the device's management interface (T1059.008).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.