{"id":"CVE-2024-1781","published":"2024-02-23T00:00:08Z","modified":"2025-04-22T16:16:21Z","title":"Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection","vendor":"Totolink","product":"X6000R AX3000","tier":"core","eol":null,"affectedVersions":[{"vendor":"Totolink","product":"X6000R AX3000","versions":["9.4.0cu.852_20230719"]}],"description":{"text":"A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The exploit has been disclosed to the public and may be used. The identifier VDB-254573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Totolink X6000R AX3000 router (firmware 9.4.0cu.852_20230719) contains a command injection flaw in the setWizardCfg function of /cgi-bin/cstecgi.cgi within the shttpd web server component. An attacker with network access to the device, and without needing credentials or user interaction, can supply crafted input to that function to inject and run operating system commands.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:54Z"},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.14809,"percentile":0.96681,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-09","exploitedFirstSeen":"2025-10-09","ransomware":false,"evidence":[{"url":"https://www.trendmicro.com/en_us/research/25/j/rondodox.html","date":"2025-10-09"},{"url":"https://blog.xlab.qianxin.com/rustduck-en/","date":"2026-06-30"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"EbeeJuly2026 Pt1","url":"https://otx.alienvault.com/pulse/6a4b3cc2ebf14a6ed2559ae1","created":"2026-07-06"},{"name":"RustDuck: An In-Depth Analysis of a Two-Stage Botnet","url":"https://otx.alienvault.com/pulse/6a4737fd1771ecc96e06197a","created":"2026-07-03"},{"name":"RustDuck: An In-Depth Analysis of a Two-Stage Botnet","url":"https://otx.alienvault.com/pulse/6a4635e7998db450b0ccdee2","created":"2026-07-02"},{"name":"RustDuck: An In-Depth Analysis of a Two-Stage Botnet.","url":"https://otx.alienvault.com/pulse/6a453ee2b51881089a5f70ea","created":"2026-07-01"},{"name":"RondoDox | Guest System attacking | EuroTarget","url":"https://otx.alienvault.com/pulse/696a8dc74871e9a34cab06a6","created":"2026-01-16"},{"name":"From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits","url":"https://otx.alienvault.com/pulse/68ef1f1c1147b89b19c4d033","created":"2025-10-15"},{"name":"From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits","url":"https://otx.alienvault.com/pulse/68edfcbbbd279218c489e1c6","created":"2025-10-14"},{"name":"RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits.","url":"https://otx.alienvault.com/pulse/68e8a86a47a46c13c5d69ab6","created":"2025-10-10"},{"name":"From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits","url":"https://otx.alienvault.com/pulse/68e86b551440846b11a598a1","created":"2025-10-10"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://vuldb.com/?id.254573","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.254573","tags":["signature","permissions-required"]},{"url":"https://github.com/Icycu123/X6000R-AX3000-Wifi-6-Giga/blob/main/2/X6000R%20AX3000%20WiFi%206%20Giga%E7%84%A1%E7%B7%9A%E8%B7%AF%E7%94%B1%E5%99%A8%E6%9C%AA%E6%8E%88%E6%9D%83rce.md","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-17506","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-17506","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-02-12","earliestUrl":"https://github.com/Icycu123/CVE-2024-1781","repos":[{"name":"Icycu123/CVE-2024-1781","url":"https://github.com/Icycu123/CVE-2024-1781","stars":0,"created":"2024-02-12"}]},"first":{"date":"2024-02-12","source":"PoC-in-GitHub","url":"https://github.com/Icycu123/CVE-2024-1781"},"provenance":"source"},"exploitRefs":["https://github.com/Icycu123/X6000R-AX3000-Wifi-6-Giga/blob/main/2/X6000R%20AX3000%20WiFi%206%20Giga%E7%84%A1%E7%B7%9A%E8%B7%AF%E7%94%B1%E5%99%A8%E6%9C%AA%E6%8E%88%E6%9D%83rce.md"],"flow":[],"timeline":[{"date":"2024-02-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Icycu123/CVE-2024-1781","provenance":"source"},{"date":"2024-02-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-1781","provenance":"source"},{"date":"2025-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/en_us/research/25/j/rondodox.html","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 387 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.34,"detail":"percentile 0.9668"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":4.41,"detail":"base score 6.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}