CVE-2024-35397

Deeper analysis

CVE-2024-35397 is a command-injection vulnerability (CWE-77) affecting the TOTOLINK CP900L wireless router running firmware version 4.1.5cu.798_B20221228. The flaw resides in the NTPSyncWithHost function, where the hostTime parameter is passed to a system command without proper sanitization, enabling an attacker to supply a malicious value that results in arbitrary command execution.

An unauthenticated attacker positioned on an adjacent network can submit a crafted HTTP request to the affected endpoint and achieve full control over the device, including the ability to read, modify, or delete data and potentially pivot to other systems on the same network segment. The vulnerability carries a CVSS 3.1 base score of 8.8, reflecting the combination of low attack complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Public references consist of the vendor site and a detailed technical report containing proof-of-concept material; neither source describes an official patch or mitigation guidance. The associated EPSS score remains low, reaching a modest peak of 0.0547 before receding, with no indication of widespread in-the-wild exploitation.