CVE-2024-42745
Published: 12 August 2024
Summary
CVE-2024-42745 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-42745 is an OS command injection vulnerability (CWE-78, CWE-94) located in the setUPnPCfg function of /cgi-bin/cstecgi.cgi on the TOTOLINK X5000r router running firmware version v9.1.0cu.2350_b20230313. The flaw permits injection of operating system commands through crafted input processed by the affected CGI endpoint.
Authenticated attackers with network access can exploit the vulnerability by sending malicious packets to the device, resulting in arbitrary command execution that affects confidentiality, integrity, and availability. The issue carries a CVSS 3.1 base score of 8.8 under the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
The single available reference is a technical report describing the injection point; no vendor advisory or patch information is provided in the source data. The associated EPSS score remains flat at 0.0647 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39758
Vulnerability details
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The OS command injection vulnerability in the web CGI interface enables exploitation of a public-facing application (T1190), execution of arbitrary Unix shell commands (T1059.004), and exploitation for privilege escalation from authenticated web access to OS-level commands (T1068).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates inputs to block special elements that would alter OS command execution.
Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Directly prevents execution of attacker-supplied code written into data memory regions.