CVE-2024-57019

TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.60% chance of exploitation in the next 30 days, 75th percentile

Published

2025-01-15

Updated

2025-03-18

Proof-of-concept exploits (1)

• tiger5671/Vulnerabilities/blob/main/TOTOLINK%20X5000R/setVpnAccountCfg/setVpnAccountCfg.md0★ · 2026-01-08

Security advisories

• https://www.totolink.net

References

• CVE Record
• NVD entry

Related

• CVE-2024-57011
• CVE-2024-57012
• CVE-2024-57013
• CVE-2024-57014
• CVE-2024-57015
• CVE-2024-57016