CVE-2023-24276

Name of the Vulnerable Software and Affected Versions TOTOLINK A7100RU version V7.4cu.2313 B20191024

Description The issue is related to a lack of input data sanitization in the settings/delStaticDhcpRules file of the TOTOLINK A7100RU router's firmware, allowing a remote attacker to execute arbitrary commands via a command injection vulnerability. The vulnerability can be exploited through the country parameter at the "setting/delStaticDhcpRules" endpoint.

Recommendations For TOTOLINK A7100RU version V7.4cu.2313 B20191024, consider disabling access to the setting/delStaticDhcpRules endpoint until a patch is available. Restrict the use of the country parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.