CVE-2023-24146
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on TOTOLINK CA300-PoE routers by injecting malicious commands into the minute parameter of the setRebootScheCfg function. Attackers can gain full control of affected devices, potentially compromising network security. Organizations using these routers are affected.
💻 Affected Systems
- TOTOLINK CA300-PoE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Router compromise allowing network traffic interception, credential theft, and use as pivot point for further attacks.
If Mitigated
Limited impact if device is isolated, properly segmented, and monitored for suspicious activity.
🎯 Exploit Status
Public proof-of-concept available on GitHub; command injection vulnerabilities are typically easy to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check TOTOLINK website for firmware updates. If available, download latest firmware and follow vendor upgrade instructions.
🔧 Temporary Workarounds
Disable remote management
allDisable remote administration/management features to prevent external exploitation
Network segmentation
allIsolate affected routers in separate network segments with strict firewall rules
🧯 If You Can't Patch
- Replace affected devices with patched or alternative models
- Implement strict network access controls and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface or CLI. If version is V6.2c.884, device is vulnerable.Check Version:
Check router web interface under System Status or use vendor-specific CLI commandsVerify Fix Applied:
Verify firmware version has been updated to a version later than V6.2c.884📡 Detection & Monitoring
Log Indicators:
- Unusual reboot schedules
- Suspicious commands in system logs
- Unexpected configuration changes
Network Indicators:
- Unusual outbound connections from router
- Traffic patterns indicating command and control
SIEM Query:
source="router_logs" AND ("setRebootScheCfg" OR "minute=" AND ("|" OR ";" OR "$" OR "`"))