CVE-2024-57014
Published: 15 January 2025
Summary
CVE-2024-57014 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates OS command injection by requiring validation of unsanitized user inputs like the recHour parameter in setScheduleCfg.
Addresses the specific flaw in firmware V9.1.0cu.2350_B20230313 by requiring timely identification, reporting, and correction through patches.
Limits damage from low-privilege (PR:L) command injection by enforcing least privilege for processes handling the vulnerable parameter.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in network-exposed router firmware directly enables remote exploitation of public-facing device (T1190) and arbitrary Unix shell command execution (T1059.004).
NVD Description
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
Deeper analysisAI
CVE-2024-57014 is an OS command injection vulnerability (CWE-78) in the TOTOLINK X5000R router running firmware version V9.1.0cu.2350_B20230313. The issue resides in the setScheduleCfg function, where the "recHour" parameter fails to properly sanitize user input, allowing arbitrary OS command execution.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low attack complexity. It requires low privileges (PR:L) and no user interaction, enabling authenticated remote attackers to inject and execute commands with high impacts on confidentiality, integrity, and availability, potentially resulting in full device compromise.
Technical details are documented in a GitHub repository at https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md. The vendor website at https://www.totolink.net/ serves as a reference for potential advisories or patches.
Details
- CWE(s)