CVE-2024-32353

The vulnerability (CWE-77) consists of the lack of proper validation and sanitization of input data passed through the 'port' parameter to the setSSServer function handled by the /cgi-bin/cstecgi.cgi endpoint. An attacker can inject malicious system commands into this parameter, which will be executed directly by the device's operating system. The attack requires no authentication or user interaction and can be performed remotely over the network.

Successful exploitation of this vulnerability allows an attacker to gain complete control over the device — execute arbitrary system commands, read and modify configuration, and potentially use the router as an entry point to the internal network.

Apply patches available from the manufacturer according to the references. Until firmware is updated, it is recommended to restrict access to the device management interface exclusively to trusted IP addresses and block access to the administrative panel from the WAN side.

TOTOLINK X5000R with firmware version V9.1.0cu.2350_B20230313