CVE-2024-22529

CRITICAL 9.8EPSS 1.7%

TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040 (handle function of formUploadFile) of /bin/boa.

CVSS v3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.73% chance of exploitation in the next 30 days, 76th percentile
Published: 2024-01-25
Updated: 2025-06-04

Proof-of-concept exploits (1)

unpWn4bL3/iot-security/blob/main/29.md

References

Related