CVE-2024-27521

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in the "setOpModeCfg" function. This security issue allows an attacker to take complete control of the device. In detail, exploitation allows unauthenticated, remote attackers to execute arbitrary system commands with administrative privileges (i.e., as user "root").

• CWE-78

• https://github.com/SpikeReply/advisories/blob/main/cve/totolink/cve-2024-27521.mdThird Party Advisory
• https://m.totolink.net/portal/article/index/id/410.htmlProduct
• https://github.com/SpikeReply/advisories/blob/main/cve/totolink/cve-2024-27521.mdThird Party Advisory
• https://m.totolink.net/portal/article/index/id/410.htmlProduct

Published

Mar 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2751The Exclusive Addons for Elementor plugin for WordPress is v…5.4
• CVE-2024-27515Osclass 5.1.2 is vulnerable to SQL Injection.7.2
• CVE-2024-27516Server-Side Template Injection (SSTI) vulnerability in liveh…9.8
• CVE-2024-27517Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerabilit…5.4
• CVE-2024-27518An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.…7.8
• CVE-2024-2752The Where Did You Hear About Us Checkout Field for WooCommer…5.5
• CVE-2024-27524Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 …7.1
• CVE-2024-27525Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 …4.6
• CVE-2024-27527wasm3 139076a is vulnerable to Denial of Service (DoS).7.5
• CVE-2024-27528wasm3 139076a suffers from Invalid Memory Read, leading to D…8.4
• CVE-2024-27529wasm3 139076a contains memory leaks in Read_utf8.8.4
• CVE-2024-2753Concrete CMS version 9 before 9.2.8 and previous versions pr…4.8