CVE-2024-24329

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-24332.7An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload f CVE-2024-243309.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the CVE-2024-243319.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiS CVE-2024-243329.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilte CVE-2024-243339.8TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAcl CVE-2024-243348.4A heap buffer overflow occurs in dfs_v2 dfs_file in RT-Thread through 5.0.2.CVE-2024-243358.4A heap buffer overflow occurs in the dfs_v2 romfs filesystem RT-Thread through 5.0.2.CVE-2024-243368.1A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Li CVE-2024-243378.0CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.CVE-2024-24348.1An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior CVE-2024-24354.3For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a CVE-2024-243508.8File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extens