CVE-2024-41319
Published: 23 July 2024
Summary
CVE-2024-41319 is a critical-severity Command Injection (CWE-77) vulnerability in Totolink A6000R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
TOTOLINK A6000R V1.0.1-B20201211.2000 contains a command injection vulnerability in the webcmd function, where the cmd parameter is passed to the system without adequate sanitization. The flaw is tracked as CWE-77 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible, unauthenticated exploitation with full confidentiality, integrity, and availability impact.
An attacker with network reachability to the device can supply crafted input to the affected parameter and execute arbitrary operating-system commands. Because no authentication or user interaction is required, remote adversaries can obtain shell access and fully compromise the router, including altering configuration, intercepting traffic, or using the device as a pivot point.
Public disclosures hosted on GitHub and Gist provide proof-of-concept details but do not reference vendor patches or official mitigation steps. The associated EPSS score has reached a peak of 0.5685 with a current value of 0.5053, indicating sustained exploitation interest following publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39009
Vulnerability details
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.