CVE-2024-57022
Published: 15 January 2025
Summary
CVE-2024-57022 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of the unsanitized sHour parameter in setWiFiScheduleCfg to block OS command injection.
Enforces restrictions on the sHour parameter, such as limiting to valid numeric hour values, preventing injection of arbitrary commands.
Mandates identification, reporting, and patching of the command injection flaw in the router firmware to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in network-accessible router function directly enables remote exploitation of public-facing device (T1190) and arbitrary command execution via Unix shell (T1059.004).
NVD Description
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.
Deeper analysisAI
CVE-2024-57022 is an OS command injection vulnerability (CWE-78) affecting the TOTOLINK X5000R router running firmware version V9.1.0cu.2350_B20230313. The issue resides in the setWiFiScheduleCfg function, where the "sHour" parameter fails to properly sanitize user input, enabling attackers to inject and execute arbitrary operating system commands.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with low attack complexity. Exploitation requires low privileges, such as those of an authenticated user, and no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially resulting in remote code execution and full compromise of the affected device.
Mitigation details can be found in the referenced advisory at https://github.com/tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setWiFiScheduleCfg/setWiFiScheduleCfg.md and on the vendor website at https://www.totolink.net/.
Details
- CWE(s)