Cyber Resilience

CVE-2024-57014

HighPublic PoCRCE

Published: 15 January 2025

Published
15 January 2025
Modified
18 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0256 85.8th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57014 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57014 is an OS command injection vulnerability (CWE-78) in the TOTOLINK X5000R router running firmware version V9.1.0cu.2350_B20230313. The issue resides in the setScheduleCfg function, where the "recHour" parameter fails to properly sanitize user input, allowing arbitrary OS command execution.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low attack complexity. It requires low privileges (PR:L) and no user interaction, enabling authenticated remote attackers to inject and execute commands with high impacts on confidentiality, integrity, and availability, potentially resulting in full device compromise.

Technical details are documented in a GitHub repository at https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md. The vendor website at https://www.totolink.net/ serves as a reference for potential advisories or patches.

EU & UK References

Vulnerability details

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in network-exposed router firmware directly enables remote exploitation of public-facing device (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57016Same product: Totolink X5000R
CVE-2024-57015Same product: Totolink X5000R
CVE-2024-57013Same product: Totolink X5000R
CVE-2024-57011Same product: Totolink X5000R
CVE-2024-57012Same product: Totolink X5000R
CVE-2024-57022Same product: Totolink X5000R
CVE-2024-57018Same product: Totolink X5000R
CVE-2024-57021Same product: Totolink X5000R
CVE-2024-57020Same product: Totolink X5000R
CVE-2024-57019Same product: Totolink X5000R

Affected Assets

totolink
x5000r firmware
9.1.0cu.2350_b20230313

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates OS command injection by requiring validation of unsanitized user inputs like the recHour parameter in setScheduleCfg.

SI-2 Flaw Remediation good match
prevent

Addresses the specific flaw in firmware V9.1.0cu.2350_B20230313 by requiring timely identification, reporting, and correction through patches.

AC-6 Least Privilege partial match
prevent

Limits damage from low-privilege (PR:L) command injection by enforcing least privilege for processes handling the vulnerable parameter.

References