CVE-2023-24152

A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2023-02-03

Last modified

2025-03-26

Weaknesses

CWE-77

Affected products

• T8 Firmware (Totolink)

References

• https://github.com/Double-q1015/CVE-vulns/blob/main/totolink_t8/meshSlaveUpdate/meshSlaveUpdate.md