CVE-2024-2353 is a high severity (8.8) OS command injection in Totolink X6000R firmware 9.4.0cu.852_20230719. The record names no fix, and the vendor did not respond. Restrict the admin interface and check Totolink for newer firmware. NVD published it on 2024-03-10. CISA does not list it as exploited.
Weakness: CWE-78 (OS Command Injection).
What's affected
- Affected: Totolink X6000R firmware 9.4.0cu.852_20230719.
- Fixed: none named. The vendor was contacted early about this disclosure but did not respond in any way, according to the record.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, network reachable with a low-privilege login and no user interaction.
The record places the flaw in the setDiagnosisCfg function of /cgi-bin/cstecgi.cgi in the shttpd component, through the ip argument. It says the exploit has been disclosed to the public. The linked write-up title calls it unauthenticated, while the NVD vector requires low privileges. We did not fetch it, so treat the privilege requirement as unsettled.
How to check if you're exposed
- Sign in to the router admin page and read the firmware version under system status. Compare it with 9.4.0cu.852_20230719.
- Check whether remote administration is enabled. Turn it off if it is.
- From outside your network, test whether the admin port answers.
If you manage a fleet, firmware images can be scanned as containers or file systems.
What to do now
- Disable remote (WAN side) administration on the router.
- Check the Totolink download page for firmware newer than 9.4.0cu.852_20230719 and install it if the notes cover this issue.
- Change the admin password and avoid reuse across devices.
- Place the router's admin interface on a management network only.
- If no fix appears, plan replacement of the device.
Why it matters
The record classes this as CWE-78 (OS Command Injection). Diagnostic pages like ping or traceroute commonly pass the address to a shell. If the input is not checked, characters meant as separators can add a second command. On a router that runs as root, that means control of the device and of traffic through it.
NVD scored it 8.8 (High). The KEV flag is false. The record does not say exploitation has been seen.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a firmware fix?
The record names none, and the vendor did not respond. Check Totolink's site.
Is login required?
The NVD vector says low privileges are required. A linked write-up says unauthenticated. Plan as if it is not required.
Sources
- CVE-2024-2353 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2353, as held in the batch record
- VulDB entry for this CVE, linked from the record
Last reviewed: 19 October 2026.
