Cyber Resilience

CVE-2024-57020

HighPublic PoCRCE

Published: 15 January 2025

Published
15 January 2025
Modified
18 March 2025
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0338 87.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57020 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

TOTOLINK X5000R firmware version V9.1.0cu.2350_B20230313 contains an OS command injection vulnerability in the setWiFiScheduleCfg function, specifically through the sMinute parameter. The flaw is tracked as CVE-2024-57020 and is classified under CWE-78, carrying a CVSS 3.1 score of 8.8 that reflects network-accessible exploitation with low attack complexity and authenticated low-privileged access.

An authenticated attacker can supply a crafted sMinute value to the affected endpoint and execute arbitrary operating-system commands on the device. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability of the router, enabling actions such as configuration changes, traffic interception, or persistence mechanisms.

The associated EPSS score rose from lower values to a peak of 0.0695 on 2025-12-11 before receding to the current 0.0338, indicating a measurable increase in observed exploitation interest after public disclosure. Public references include a detailed proof-of-concept but no vendor advisory describing patches or configuration mitigations.

EU & UK References

Vulnerability details

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

OS command injection in router web management interface directly enables remote exploitation of public-facing apps and arbitrary Unix shell command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57016Same product: Totolink X5000R
CVE-2024-57015Same product: Totolink X5000R
CVE-2024-57013Same product: Totolink X5000R
CVE-2024-57011Same product: Totolink X5000R
CVE-2024-57012Same product: Totolink X5000R
CVE-2024-57014Same product: Totolink X5000R
CVE-2024-57022Same product: Totolink X5000R
CVE-2024-57018Same product: Totolink X5000R
CVE-2024-57021Same product: Totolink X5000R
CVE-2024-57019Same product: Totolink X5000R

Affected Assets

totolink
x5000r firmware
9.1.0cu.2350_b20230313

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the OS command injection by requiring validation of the unsanitized sMinute parameter in setWiFiScheduleCfg.

prevent

Ensures timely firmware updates to remediate the specific flaw allowing arbitrary command execution on the TOTOLINK X5000R.

prevent

Restricts the sMinute parameter to valid inputs like numeric values 0-59, blocking malformed payloads used for command injection.

References