Cyber Resilience

CVE-2024-57017

HighPublic PoCRCE

Published: 15 January 2025

Published
15 January 2025
Modified
13 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0338 87.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57017 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

TOTOLINK X5000R firmware version V9.1.0cu.2350_B20230313 contains an OS command injection vulnerability (CWE-78) in the setVpnAccountCfg function, triggered through the "pass" parameter. The flaw carries a CVSS 3.1 score of 8.8 and permits unauthenticated command execution on the affected router when the parameter is supplied over the network.

An attacker with valid credentials and network reachability can supply a crafted "pass" value that results in arbitrary operating-system command execution. Successful exploitation grants the attacker full control over device confidentiality, integrity, and availability, consistent with the high impact metrics.

The supplied references consist of a technical write-up hosted on GitHub and the vendor homepage; neither document details an official patch or mitigation steps. The EPSS score reached a peak of 0.0695 on 2025-12-11 before receding to its current value of 0.0338.

EU & UK References

Vulnerability details

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
Why these techniques?

OS command injection in the authenticated web interface of a network device directly enables remote exploitation of a public-facing application (T1190) and arbitrary command execution via the network device CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57016Same product: Totolink X5000R
CVE-2024-57015Same product: Totolink X5000R
CVE-2024-57013Same product: Totolink X5000R
CVE-2024-57011Same product: Totolink X5000R
CVE-2024-57012Same product: Totolink X5000R
CVE-2024-57014Same product: Totolink X5000R
CVE-2024-57022Same product: Totolink X5000R
CVE-2024-57018Same product: Totolink X5000R
CVE-2024-57021Same product: Totolink X5000R
CVE-2024-57020Same product: Totolink X5000R

Affected Assets

totolink
x5000r firmware
9.1.0cu.2350_b20230313

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 mandates input validation and error handling at system boundaries, directly preventing OS command injection via insufficiently validated 'pass' parameter in setVpnAccountCfg.

SI-9 Information Input Restrictions good match
prevent

SI-9 enforces restrictions on information inputs such as character sets and formats, blocking malicious payloads in the 'pass' parameter that enable command injection.

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely identification, reporting, and correction of flaws like this OS command injection vulnerability through patching or code remediation.

References