cbcvebase.
CVE-2024-24328
published 2024-01-30

CVE-2024-24328: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.

PriorityP184critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.17%
92.7th percentile
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.

Affected

1 ranges
VendorProductVersion rangeFixed in
totolinka3300r_firmware——

Detection & IOCsextracted from sources · hover to see the quote

url/cgi-bin/cstecgi.cgi?token=↗
command{"enable":"1`ls>/web/{{randstr}}.txt`","addEffect":"0","topicurl":"setMacFilterRules"}↗
path/web/↗
  • →Exploit targets HTTP POST to /cgi-bin/cstecgi.cgi with topicurl=setMacFilterRules and a backtick-injected OS command in the 'enable' parameter; no authentication required (token= is empty). ↗
  • →Successful exploitation returns HTTP 200 with JSON body containing '"success":true' on the POST, and a follow-up GET to the dropped .txt file returns directory listing output including 'bin' and 'etc'. ↗
  • →The attack uses backtick command substitution inside a JSON string value for the 'enable' field to inject arbitrary OS commands (e.g., ls redirected to a web-accessible file). ↗
  • →FOFA fingerprinting query for exposed vulnerable devices uses the page title 'totolink'. ↗
  • →Request includes X-Requested-With: XMLHttpRequest and Accept: application/json headers; monitor for unauthenticated POST requests to cstecgi.cgi matching this pattern. ↗
  • ·Vulnerability is unauthenticated — the token parameter is sent empty, meaning no credentials are needed to exploit the command injection. ↗
  • ·Affected firmware version is strictly V17.0.0cu.557_B20221024 on TOTOLINK A3300R; detections should be scoped to this CPE. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.