CVE-2024-52723

In the shttpd file of TOTOLINK X6000R firmware, the Uci_Set_Str function processes input data without proper parameter filtering. An attacker can construct a specially crafted payload containing malicious system commands that will be executed by the device without any verification. The vulnerability is accessible remotely over the network without requiring any credentials.

Attacker gains the ability to execute arbitrary commands with the privileges of the shttpd process on the device, which in practice means complete takeover of the router — violation of confidentiality, integrity and availability of the system.

Security patches available from the manufacturer should be applied in accordance with the references. Until the update is applied, it is recommended to restrict access to the device management interface to trusted IP addresses only and isolate the device from the public Internet.

TOTOLINK X6000R in firmware version V9.4.0cu.1041_B20240224