CVE-2024-2353

A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-78

• https://github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.mdExploit, Vendor Advisory
• https://vuldb.com/?ctiid.256313Permissions Required
• https://vuldb.com/?id.256313Third Party Advisory, VDB Entry
• https://github.com/OraclePi/repo/blob/main/totolink%20X6000R/1/X6000R%20AX3000%20WiFi%206%20Giga%20unauthed%20rce.mdExploit, Vendor Advisory
• https://vuldb.com/?ctiid.256313Permissions Required
• https://vuldb.com/?id.256313Third Party Advisory, VDB Entry

Published

Mar 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23524Missing Authorization vulnerability in ONTRAPORT Inc. PilotP…8.8
• CVE-2024-23525The Spreadsheet::ParseXLSX package before 0.30 for Perl allo…6.5
• CVE-2024-23526An out-of-bounds read vulnerability in WLAvalancheService co…7.5
• CVE-2024-23527An out-of-bounds read vulnerability in WLAvalancheService co…7.5
• CVE-2024-23528An out-of-bounds read vulnerability in WLAvalancheService co…7.5
• CVE-2024-23529An out-of-bounds read vulnerability in WLAvalancheService co…7.5
• CVE-2024-23530An out-of-bounds read vulnerability in WLAvalancheService co…7.5
• CVE-2024-23531An Integer Overflow vulnerability in WLInfoRailService compo…7.5
• CVE-2024-23532An out-of-bounds Read vulnerability in WLAvalancheService co…7.5
• CVE-2024-23533An out-of-bounds read vulnerability in WLAvalancheService co…6.5
• CVE-2024-23534An Unrestricted File-upload vulnerability in web component o…8.8
• CVE-2024-23535A Path Traversal vulnerability in web component of Ivanti Av…8.8