CVE-2023-24148
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on TOTOLINK CA300-PoE routers by injecting malicious commands into the FileName parameter of the setUploadUserData function. Attackers can gain full control of affected devices, potentially compromising network security. All users of TOTOLINK CA300-PoE V6.2c.884 are affected.
💻 Affected Systems
- TOTOLINK CA300-PoE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data exfiltration, lateral movement to other systems, and persistent backdoor installation.
Likely Case
Remote code execution allowing attackers to modify device configuration, intercept network traffic, or use the device as a foothold for further attacks.
If Mitigated
Limited impact if device is isolated from critical networks and has strict network access controls.
🎯 Exploit Status
Public exploit code available in GitHub repository. Simple HTTP request with command injection payload required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Check TOTOLINK website for firmware updates. If update available, download from official source and apply through web interface.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict access to device management interface
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disable Web Interface
allDisable HTTP management if not required
telnet/ssh to device and disable httpd service if supported
🧯 If You Can't Patch
- Segment affected devices in isolated VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in web interface. If version is V6.2c.884, device is vulnerable.Check Version:
curl -s http://device-ip/version or check web interfaceVerify Fix Applied:
Check if firmware version has been updated to a version later than V6.2c.884📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to setUploadUserData endpoint
- Commands like 'wget', 'curl', 'nc', 'bash' in URL parameters
Network Indicators:
- HTTP requests with shell metacharacters in parameters
- Outbound connections from device to unexpected destinations
SIEM Query:
http.url:*setUploadUserData* AND (http.uri:*;* OR http.uri:*|* OR http.uri:*`* OR http.uri:*$(*)