CVE-2024-57211
Published: 10 January 2025
Summary
CVE-2024-57211 is a high-severity Command Injection (CWE-77) vulnerability in Totolink A6000R Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57211 is a command injection vulnerability (CWE-77) in the TOTOLINK A6000R router, specifically version V1.0.1-B20201211.2000. The issue resides in the enable_wsh function, where the modifyOne parameter fails to properly sanitize user input, allowing arbitrary command execution.
The vulnerability carries a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). An attacker with adjacent network access (AV:A) and low privileges (PR:L) can exploit it with low complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability in the unchanged scope. Successful exploitation enables remote command injection, potentially leading to full router compromise.
References point to a GitHub repository documenting the vulnerability and proof-of-concept: https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_11_enable_wsh/README.md. No vendor advisories or patches are specified in the available details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53541
Vulnerability details
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via web parameter in router firmware enables exploitation of public-facing application (T1190) and arbitrary command execution on the network device CLI (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the command injection vulnerability by requiring validation and sanitization of the unsanitized modifyOne parameter in the enable_wsh function.
Addresses the root cause by requiring timely identification, reporting, and correction of the specific flaw enabling arbitrary command execution in the router firmware.
Prevents command injection by restricting the modifyOne parameter to valid inputs, blocking shell metacharacters and malformed data passed to the enable_wsh function.