CVE-2024-22529 Command injection in n/a

Critical 9.8 Published 25 Jan 2024 Updated 4 Jun 2025

Attackers can execute arbitrary commands on TOTOLINK X2000R_V2 routers via a vulnerability in the file upload handler.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-22529?

CVE-2024-22529 is a critical command injection vulnerability in n/a, published on 25 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040 (handle function of formUploadFile) of /bin/boa.

Weakness: CWE-77

Which versions are affected by CVE-2024-22529?

It affects 1 product.

Products include Totolink X2000r Firmware.

How do I fix CVE-2024-22529?

No fix has been published for CVE-2024-22529 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-22529 being exploited?

There is no known exploitation of CVE-2024-22529 in the wild and no public exploit code.

Sources

Also known as GHSA-rx6w-gc3r-2fh2.