Cyber Resilience

CVE-2024-42745

HighPublic PoCRCE

Published: 12 August 2024

Published
12 August 2024
Modified
13 August 2024
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0647 91.3th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-42745 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2024-42745 is an OS command injection vulnerability (CWE-78, CWE-94) located in the setUPnPCfg function of /cgi-bin/cstecgi.cgi on the TOTOLINK X5000r router running firmware version v9.1.0cu.2350_b20230313. The flaw permits injection of operating system commands through crafted input processed by the affected CGI endpoint.

Authenticated attackers with network access can exploit the vulnerability by sending malicious packets to the device, resulting in arbitrary command execution that affects confidentiality, integrity, and availability. The issue carries a CVSS 3.1 base score of 8.8 under the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The single available reference is a technical report describing the injection point; no vendor advisory or patch information is provided in the source data. The associated EPSS score remains flat at 0.0647 with no material increase after disclosure.

EU & UK References

Vulnerability details

In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

The OS command injection vulnerability in the web CGI interface enables exploitation of a public-facing application (T1190), execution of arbitrary Unix shell commands (T1059.004), and exploitation for privilege escalation from authenticated web access to OS-level commands (T1068).

Affected Assets

totolink
x5000r firmware
9.1.0u.6369_b20230113

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78 CWE-94

Validates inputs to block special elements that would alter OS command execution.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-94

Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.

addresses: CWE-94

Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.

addresses: CWE-94

Directly prevents execution of attacker-supplied code written into data memory regions.

References