CVE-2024-42741: OS Command Injection
In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42741?
CVE-2024-42741 has a high severity due to the OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands.
How do I fix CVE-2024-42741?
To fix CVE-2024-42741, update your TOTOLINK X5000R firmware to the latest version that addresses the vulnerability.
Who is affected by CVE-2024-42741?
Users of the TOTOLINK X5000R firmware version 9.1.0u.6369_b20230113 are affected by CVE-2024-42741.
What components of Totolink X5000R are vulnerable in CVE-2024-42741?
The vulnerable component in CVE-2024-42741 is the /cgi-bin/cstecgi.cgi file used in the setL2tpServerCfg function.
Can CVE-2024-42741 be exploited without authentication?
No, CVE-2024-42741 can only be exploited by authenticated attackers.