CVE-2024-35397

high · 8.8

TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

8.8

CVSS

15.1%

EPSS (exploit prob.)

97th

EPSS percentile

2024-05-28

Published

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
totolink	cp900l_firmware	4.1.5cu.798_b20221228
totolink	cp900l	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK%20CP900L/NTPSyncWithHost/README.md
https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK%20CP900L/NTPSyncWithHost/README.md

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-35397