CVE-2024-57019
Published: 15 January 2025
Summary
CVE-2024-57019 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
TOTOLINK X5000R firmware version V9.1.0cu.2350_B20230313 contains an OS command injection vulnerability in the setVpnAccountCfg function, specifically through the "limit" parameter. The flaw is tracked as CVE-2024-57019 with a CVSS 3.1 score of 8.8 and is classified under CWE-78.
An authenticated attacker with network access can supply a crafted "limit" value to execute arbitrary operating system commands on the device. Successful exploitation grants the attacker full control over the router, including the ability to read, modify, or delete data and disrupt device operation.
The provided references consist of a technical disclosure on GitHub and the vendor homepage; neither contains explicit patch details or mitigation guidance.
EPSS for the CVE rose from low values after the January 2025 disclosure to a peak of 0.0695 in December 2025 before receding to the current 0.0338, indicating a period of increased exploitation interest following public release.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53492
Vulnerability details
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in setVpnAccountCfg directly enables arbitrary Unix shell command execution on the router firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires input validation at entry points like the 'limit' parameter to neutralize special elements and prevent OS command injection.
Mandates timely flaw remediation, including patching the firmware vulnerability in setVpnAccountCfg to eliminate the command injection flaw.
Enforces least privilege for low-privileged authenticated users, limiting the scope and impact of arbitrary OS commands executed through the vulnerability.