CVE-2024-35397 - TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter

Back Back to CVE browser

HIGH

TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter

Published May 28, 2024

8.8

HIGH

CVSS 3.1

EPSS 15.10%

Description

TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

Vendor TOTOLINK Product Cp900l Firmware Default
n/a
- Version
  4.1.5cu798_b20221228
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TOTOLINK

Cp900l Firmware

n/a

Version	Status	Constraints
4.1.5cu798_b20221228	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (1)

https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK%20CP900L/NTPSyncWithHost/README.md
Broken Link

Link	Providers	Tags
https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/TOTOLINK%20CP900L/NTPSyncWithHost/README.md		Broken Link

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published May 28, 2024

Updated Jul 9, 2026

Reserved May 17, 2024

Link CVE-2024-35397

CISA Vulnrichment

Updated Aug 19, 2024

NVD

Status Modified

Modified Jul 9, 2026

Link CVE-2024-35397

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-35397