CVE-2024-57013
Published: 15 January 2025
Summary
CVE-2024-57013 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
TOTOLINK X5000R firmware version V9.1.0cu.2350_B20230313 contains an OS command injection vulnerability (CWE-78) in the setScheduleCfg function, specifically through the "switch" parameter. The flaw carries a CVSS 3.1 score of 8.8 and permits remote attackers to execute arbitrary operating system commands on the affected router.
An authenticated user with network access can supply a malicious value to the vulnerable parameter and trigger command execution. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the device without requiring user interaction.
The referenced GitHub disclosure provides a proof-of-concept while the vendor homepage offers no published mitigation guidance or patch information at the time of reporting. The EPSS score rose from a low baseline to a peak of 0.0695 on 2025-12-11 before receding to the current value of 0.0366, indicating a temporary increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53486
Vulnerability details
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in internet-facing router web function directly enables remote exploitation of public-facing app (T1190) and Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires input validation mechanisms at entry points like the 'switch' parameter to sanitize user input and block OS command injection.
Mandates identification, reporting, and timely patching of flaws like this firmware command injection vulnerability to prevent exploitation.
Enforces restrictions on information inputs at boundaries to limit the 'switch' parameter to safe values, preventing injection of arbitrary commands.