# CVE-2024-1781 — Totolink X6000R AX3000

> As of 2025-04-22, CVE-2024-1781 is a MEDIUM-severity vulnerability in Totolink X6000R AX3000, CVSS v3.1 6.3, EPSS 14.6% (96.2th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2024-1781, most recently “RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector Exploitation”.

**Last updated:** 2025-04-22

## What is CVE-2024-1781?

A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The exploit has been disclosed to the public and may be used. The identifier VDB-254573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The record classifies CVE-2024-1781 under weakness class [CWE-77](https://intel.threadlinqs.com/cwe/CWE-77). Its CVSS v3 base vector states that the flaw is reachable from an adjacent network, needs no prior authentication, needs no user interaction. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 955 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 6.3 — MEDIUM (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L`)
- **EPSS (FIRST):** 14.6% probability of exploitation in the next 30 days, higher than 96.2% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 9/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2024-02-23, last modified 2025-04-22

## Is CVE-2024-1781 being exploited?

Weaponised exploit code for CVE-2024-1781 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier.

- [Icycu123/CVE-2024-1781](https://github.com/Icycu123/CVE-2024-1781) (github)
- [trickest/cve](https://github.com/trickest/cve/blob/main/2024/CVE-2024-1781.md) (trickest)

## Affected products and versions

- **Totolink**: X6000R AX3000

## How to fix CVE-2024-1781

No vendor patch reference has been recorded for CVE-2024-1781 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2024-1781

1 tracked threat in the Threadlinqs corpus references CVE-2024-1781, either in the campaign’s CVE list or as an indicator on the campaign record.

- [RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector Exploitation](https://intel.threadlinqs.com/threat/TL-2026-1006) — CRITICAL · 2026-06-30

## Sources

Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-07-09. This product uses the NVD API but is not endorsed or certified by the NVD.

**Exploit and proof of concept**

- [github.com — exploit](https://github.com/Icycu123/X6000R-AX3000-Wifi-6-Giga/blob/main/2/X6000R%20AX3000%20WiFi%206%20Giga%E7%84%A1%E7%B7%9A%E8%B7%AF%E7%94%B1%E5%99%A8%E6%9C%AA%E6%8E%88%E6%9D%83rce.md)

**Technical analysis**

- [vuldb.com — vdb entry](https://vuldb.com/?id.254573)

**Third-party advisory**

- [vuldb.com — signature](https://vuldb.com/?ctiid.254573)

Canonical: https://intel.threadlinqs.com/cve/CVE-2024-1781
Full detection coverage and IOCs for threats exploiting CVE-2024-1781 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp