CVE-2024-57015
Published: 15 January 2025
Summary
CVE-2024-57015 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly addresses the lack of sanitization in the 'hour' parameter by requiring validation of user inputs to prevent OS command injection.
SI-2 ensures timely remediation of the specific flaw in the setScheduleCfg function through firmware updates or patches.
SI-9 restricts the 'hour' parameter to valid values (e.g., integers 0-23), blocking malformed inputs that enable command injection.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in network device web interface directly enables remote exploitation of public-facing app (T1190) and Unix shell command execution (T1059.004).
NVD Description
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.
Deeper analysisAI
CVE-2024-57015 is an OS command injection vulnerability (CWE-78) affecting the TOTOLINK X5000R router firmware version V9.1.0cu.2350_B20230313. The issue resides in the setScheduleCfg function, where the "hour" parameter fails to properly sanitize user input, enabling attackers to inject and execute arbitrary operating system commands.
The vulnerability carries a CVSS v3.1 base score of 8.8 (High), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It can be exploited remotely over the network by low-privileged authenticated users without requiring user interaction. Successful exploitation allows attackers to achieve high impacts across confidentiality, integrity, and availability, potentially leading to full device compromise through arbitrary command execution.
Advisories and mitigation details can be found in the vendor's security resources at https://www.totolink.net/ and the detailed vulnerability report at https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setScheduleCfg/setScheduleCfg.md, published on 2025-01-15.
Details
- CWE(s)