CVE-2024-57016
Published: 15 January 2025
Summary
CVE-2024-57016 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
TOTOLINK X5000R firmware version V9.1.0cu.2350_B20230313 contains an OS command injection vulnerability tracked as CVE-2024-57016. The flaw is present in the setVpnAccountCfg function and is triggered through the user parameter, corresponding to CWE-78. The issue received a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, and low required privileges.
An authenticated attacker with network access can supply a crafted user value that results in arbitrary command execution on the device. Successful exploitation grants the attacker the ability to read, modify, or delete data and to fully compromise the confidentiality, integrity, and availability of the affected router.
The EPSS score for this CVE rose from a low baseline to a peak of 0.0695 on 2025-12-11 before receding to the current value of 0.0338, indicating a measurable increase in observed exploitation interest after public disclosure. No vendor advisory or patch information is provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53489
Vulnerability details
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in public-facing router web interface directly enables T1190 exploitation and T1059.004 Unix shell command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires input validation at external interfaces, directly preventing OS command injection by sanitizing the unsanitized 'user' parameter in setVpnAccountCfg.
Mandates identification, reporting, and correction of flaws like this command injection vulnerability through timely firmware patching.
Enables vulnerability scanning to identify and address this specific CVE in router firmware before exploitation.