CVE-2023-29803: TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

2.16%

80.1th percentile

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
totolink	x18_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/cstecgi.cgi

→Exploit targets HTTP POST requests to /cgi-bin/cstecgi.cgi with a JSON body containing 'topicurl':'disconnectVPN' and a 'pid' parameter carrying shell metacharacters for command injection.
→The injected payload in the 'pid' parameter uses shell metacharacters: semicolon (;/%3B), newline (\n/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24). Detection regex targets these characters after the pid value.
→Vulnerability is in the disconnectVPN function of TOTOLINK X18 V9.1.0cu.2024_B20220329; the 'pid' parameter is passed unsanitized to a system command. ↗
→Traffic is plaintext (non-TLS); deploy detection at perimeter and internal network boundaries monitoring inbound HTTP to networking equipment.

·The Snort/Suricata rule (sid:2068159) covers both CVE-2023-29803 and CVE-2024-34921 simultaneously, as both share the same vulnerable endpoint and injection vector; tuning may be needed to distinguish between the two CVEs.
·The URI match uses bsize:20, meaning it matches exactly on the 20-byte path /cgi-bin/cstecgi.cgi; ensure your HTTP normalisation does not alter URI length before inspection.

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.