Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection
Totolink · X6000R AX3000
The Totolink X6000R AX3000 router (firmware 9.4.0cu.852_20230719) contains a command injection flaw in the setWizardCfg function of /cgi-bin/cstecgi.cgi within the shttpd web server component. An attacker with network access to the device, and without needing credentials or user interaction, can supply crafted input to that function to inject and run operating system commands.
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The exploit has been disclosed to the public and may be used. The identifier VDB-254573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 20 months after disclosure. Public exploit code (PoC-in-GitHub) was available 11 days before disclosure.
- Public exploit codePoC-in-GitHub11 days before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+20 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.