CVE-2024-0579 is a medium severity command injection flaw in Totolink X2000R, scored CVSS 6.3. The record lists Totolink X2000R firmware 1.0.0-B20221212.1452. The vendor did not respond to early contact, so no fix is known from the record. Use the steps below to confirm your exposure and plan the fix.
What's affected
The record lists Totolink X2000R firmware 1.0.0-B20221212.1452. The formMapDelDevice function in /boafrm/formMapDelDevice mishandles the macstr argument.
The record places the flaw in the formMapDelDevice function of /cgi-bin/cstecgi.cgi or the named handler, reachable remotely, with a public disclosure noted. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
Fixed version: The vendor did not respond to early contact, so no fix is known from the record.
Where sources differ: The VulDB description calls the issue critical, while the CVSS score in the record is 6.3, which is Medium.
How to check if you're exposed
Log in to the router admin page and read the firmware version on the status or system page, then compare it with the version named in the record. Also check whether the admin page is reachable from the WAN side.
The request path /cgi-bin/cstecgi.cgi is the common web handler on these devices, so any exposure of the admin interface to the internet is worth closing regardless of the firmware version.
What to do now
- Turn off remote administration from the WAN side and limit the admin page to a trusted management network.
- Check the vendor site for the firmware version named in the advisory and install it where one exists.
- If the vendor offers no fix, plan to replace the device or place it behind a firewall that blocks access to its web interface.
- Change administrator credentials and wireless keys if the device was ever exposed.
Why it matters
CWE-74 describes this class. Injection is the parent class for flaws where input changes the meaning of a command or query in a downstream component. Treating all request parameters as untrusted data is the general fix.
CWE-77 describes this class. Command injection means input is passed into a system command without being neutralized, so part of the input is interpreted as command syntax. Allow lists for expected values and avoiding shell calls altogether are the standard defences.
The record notes that an exploit has been disclosed publicly, which shortens the time between disclosure and scanning by others. The record does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Quick check
Is CVE-2024-0579 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
What if the vendor never ships a fix?
Limit the admin interface to a trusted network, disable remote management, and plan to replace the device.
Sources
- Safeguard Gold entry for CVE-2024-0579
- NVD record data for CVE-2024-0579, including the references listed there (the other reference pages were not fetched for this post).
Last reviewed: 19 October 2026.
