Cyber Resilience

CVE-2024-57022

HighPublic PoCRCE

Published: 15 January 2025

Published
15 January 2025
Modified
19 March 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0338 87.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57022 is a high-severity OS Command Injection (CWE-78) vulnerability in Totolink X5000R Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The vulnerability CVE-2024-57022 is an OS command injection flaw (CWE-78) in TOTOLINK X5000R firmware version V9.1.0cu.2350_B20230313. It occurs due to insufficient sanitization of the "sHour" parameter in the setWiFiScheduleCfg function, enabling arbitrary operating system command execution.

An attacker with network access and low privileges can supply crafted input to the affected parameter and achieve command execution that impacts confidentiality, integrity, and availability. The issue carries a CVSS 3.1 score of 8.8 under the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS for the CVE rose from lower values to a peak of 0.0695 on 2025-12-11 before receding to the current 0.0338, indicating increased exploitation interest after disclosure. Available references consist of a technical report on GitHub and the vendor site, with no further mitigation or patch details provided.

EU & UK References

Vulnerability details

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sHour" parameter in setWiFiScheduleCfg.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

OS command injection in network-accessible router function directly enables remote exploitation of public-facing device (T1190) and arbitrary command execution via Unix shell (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-57016Same product: Totolink X5000R
CVE-2024-57015Same product: Totolink X5000R
CVE-2024-57013Same product: Totolink X5000R
CVE-2024-57011Same product: Totolink X5000R
CVE-2024-57012Same product: Totolink X5000R
CVE-2024-57014Same product: Totolink X5000R
CVE-2024-57018Same product: Totolink X5000R
CVE-2024-57021Same product: Totolink X5000R
CVE-2024-57020Same product: Totolink X5000R
CVE-2024-57019Same product: Totolink X5000R

Affected Assets

totolink
x5000r firmware
9.1.0cu.2350_b20230313

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation of the unsanitized sHour parameter in setWiFiScheduleCfg to block OS command injection.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on the sHour parameter, such as limiting to valid numeric hour values, preventing injection of arbitrary commands.

SI-2 Flaw Remediation good match
prevent

Mandates identification, reporting, and patching of the command injection flaw in the router firmware to eliminate the vulnerability.

References