CVE-2024-2353

CVSS 3.1 Score 8.8 of 10 (high)

Details

Published Mar 10, 2024
Updated: Dec 16, 2024
CWE ID 269

Summary

CVE-2024-2353 is a newly disclosed critical vulnerability affecting the shttpd component in Totolink X6000R 9.4.0cu.852_20230719. The function setDiagnosisCfg in the file /cgi-bin/cstecgi.cgi contains a flaw that allows attackers to inject os commands by manipulating the ip argument. This vulnerability can be exploited remotely, and the exploit has already been made public. The identifier VDB-256313 has been assigned to this issue. Unfortunately, the vendor was contacted about this disclosure but failed to respond.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Apache Fineract

Affected Vendors

  • Apache Software Foundation

Advisories, Assessments, and Mitigations