CVE-2024-52723: OS Command Injection
Published Nov 22, 2024
·Updated
In TOTOLINK X6000R V9.4.0cu.1041B20240224 in the shttpd file, the UciSet Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.
Affected Software
2 affected components
All of the following
TOTOLINK X6000R Firmware=9.4.0cu.1041_b20240224
TOTOLINK X6000R
Event History
Nov 22, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-52723?
CVE-2024-52723 has a high severity due to the potential for arbitrary command execution.
2
How do I fix CVE-2024-52723?
To fix CVE-2024-52723, update the firmware of the TOTOLINK X6000R to the latest version provided by the vendor.
3
What versions are affected by CVE-2024-52723?
CVE-2024-52723 affects the TOTOLINK X6000R firmware version 9.4.0cu.1041_B20240224.
4
What type of vulnerability is CVE-2024-52723?
CVE-2024-52723 is a remote command execution vulnerability due to improper parameter filtering.
5
Who is impacted by CVE-2024-52723?
Users of the TOTOLINK X6000R router running the specified affected firmware are at risk from CVE-2024-52723.