CVE-2024-24329
published 2024-01-30CVE-2024-24329: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules…
PriorityP184critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.17%
92.7th percentile
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | a3300r_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit POST request targets /cgi-bin/cstecgi.cgi with topicurl=setPortForwardRules and backtick command injection in the 'enable' parameter; look for backtick or shell metacharacters in the enable field of JSON POST bodies to this endpoint. ↗
- →Successful exploitation writes a file under /web/ on the router filesystem; a subsequent GET request to retrieve the dropped file (e.g., /<randstr>.txt) containing directory listing output ('bin','etc') confirms RCE. ↗
- →The exploit uses a hardcoded token value 'C6F41C563E86A379' in both the URL query string and the Referer header; presence of this token in HTTP traffic to a TOTOLINK device is a strong indicator of exploitation attempts. ↗
- →FOFA/Shodan hunting query for exposed vulnerable devices uses the page title 'totolink'; use this to identify internet-facing instances. ↗
- →The vulnerability is unauthenticated (PR:N) and network-reachable (AV:N); no prior authentication is required to trigger command injection via the enable parameter in setPortForwardRules. ↗
- ·The token value 'C6F41C563E86A379' used in the PoC is hardcoded for demonstration; real-world exploitation may use different or dynamically obtained tokens, so detection should not rely solely on this specific token value. ↗
- ·Affected firmware is specifically TOTOLINK A3300R V17.0.0cu.557_B20221024; detections should be scoped to this CPE to avoid false positives on other TOTOLINK models. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
vendor_oracle5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3qmj-w5mh-5gv3: TOTOLINK A3300R V17
ghsa_unreviewed·2024-01-30
CVE-2024-24329 [CRITICAL] CWE-78 GHSA-3qmj-w5mh-5gv3: TOTOLINK A3300R V17
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.
VulnCheck
totolink a3300r_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2024·CVSS 9.8
CVE-2024-24329 [CRITICAL] totolink a3300r_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
totolink a3300r_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.
Affected: totolink a3300r_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-12&host_type=src&vulnerability=cve-2024-24329; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-02-13&host_type=src&vulnerability=cve-2024-24329; https://dashboard.shadowserver.org/s
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (JetBrains Kotlin) — CVE-2022-24329
vendor_oracle·2024-04-15·CVSS 5.3
CVE-2022-24329 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Third Party (JetBrains Kotlin) — CVE-2022-24329
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (JetBrains Kotlin) vulnerability
CVE: CVE-2022-24329
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2024 (APR 2024)
No detection rules found.
Nuclei
TotoLink Router setPortForwardRules - Command Injection
nuclei·CVSS 9.8
CVE-2024-24329 [CRITICAL] TotoLink Router setPortForwardRules - Command Injection
TotoLink Router setPortForwardRules - Command Injection
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.
Template:
id: CVE-2024-24329
info:
name: TotoLink Router setPortForwardRules - Command Injection
author: pussycat0x
severity: critical
description: |
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.
impact: |
Unauthenticated attackers can execute arbitrary OS commands via the enable parameter, potentially compromising the entire TOTOLINK router.
remediation: |
Update TOTOLINK A3300R firmware to a version newer than V17.0.0cu.557_B20221024.
reference:
- https://
No writeups or analysis indexed.
2024-01-30
Published
Exploited in the wild