Cyber Resilience

CVE-2024-57012

HighPublic PoCRCE

Published: 15 January 2025

Published
15 January 2025
Modified
14 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0366 88.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57012 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

TOTOLINK X5000R firmware version V9.1.0cu.2350_B20230313 contains an OS command injection vulnerability (CWE-78) in the setScheduleCfg function. The flaw is triggered through the "week" parameter and carries a CVSS 3.1 score of 8.8, reflecting network attack vector, low complexity, and low required privileges.

An authenticated attacker with network access can supply a crafted "week" value that results in arbitrary command execution on the device. Successful exploitation grants the attacker the ability to read, modify, or delete data and to fully compromise the router's confidentiality, integrity, and availability.

The EPSS score rose from a low baseline to a peak of 0.0695 on 2025-12-11 before receding to its current value of 0.0366, indicating a measurable increase in observed exploitation interest after disclosure. No vendor advisory or patch information is provided in the available references.

EU & UK References

Vulnerability details

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in public-facing router firmware directly enables T1190 exploitation and Unix shell command execution via T1059.004.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57016Same product: Totolink X5000R
CVE-2024-57015Same product: Totolink X5000R
CVE-2024-57013Same product: Totolink X5000R
CVE-2024-57011Same product: Totolink X5000R
CVE-2024-57014Same product: Totolink X5000R
CVE-2024-57022Same product: Totolink X5000R
CVE-2024-57018Same product: Totolink X5000R
CVE-2024-57021Same product: Totolink X5000R
CVE-2024-57020Same product: Totolink X5000R
CVE-2024-57019Same product: Totolink X5000R

Affected Assets

totolink
x5000r firmware
9.1.0cu.2350_b20230313

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of the 'week' parameter to block OS command injection in setScheduleCfg.

SI-2 Flaw Remediation good match
preventrecover

Ensures timely remediation of the command injection flaw through firmware updates as recommended by the vendor.

SI-9 Information Input Restrictions good match
prevent

Restricts the 'week' parameter to valid schedule values, preventing injection of arbitrary OS commands.

References