CVE-2024-0299 is a high severity (CVSS 7.3) OS command injection weakness in Totolink N200RE. No fixed version is confirmed in the record, so check the vendor or project page. The record says an exploit has been disclosed to the public. It is not listed as exploited in the wild by CISA.
What's affected
The affected firmware is N200RE 9.3.5u.6139_B20201216 from Totolink, together with the N200RE hardware entry. The vulnerable function is setTracerouteCfg in /cgi-bin/cstecgi.cgi, and the manipulated argument is command.
The weakness is mapped to CWE-78, OS command injection. The record was published on 2024-01-08. The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog.
The sources disagree on severity. The description, which comes from VulDB, calls the issue critical. NVD's CVSS 3.1 score is 7.3, which is High, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Both ratings are published. Plan around the rating that matches your exposure: an internet facing copy deserves the more urgent reading.
The description also says the vendor was contacted early about this disclosure but did not respond in any way, so there is no vendor advisory to point to and no fix is confirmed.
How to check if you're exposed
There is no vendor advisory to follow, so check the device itself. Log in to the router admin interface and read the firmware version from the status or system information page, then compare it to the version listed above. You can also check whether the admin interface answers from the internet side of the router, for example by opening the router public address on ports 80, 443 or 8080 from a connection outside your network. If it answers, treat the exposure as real.
You can also paste a manifest or SBOM into the free in-browser scanner at Safeguard Gold to see which known CVEs apply to your dependencies. It only covers components that appear in a manifest or SBOM, so a standalone appliance still needs the manual check.
What to do now
- Find every deployment of Totolink N200RE in your environment, including test systems and anything bought or installed by a team outside IT.
- Check the vendor or project page for a fixed release. None is confirmed in the record, so do not assume that upgrading to the latest version resolves it until the notes say so.
- Turn off remote management so the admin interface is not reachable from the internet.
- Restrict the admin interface to a trusted management network or a single host.
- Plan to replace the device if the vendor does not publish a patched firmware, since no fix is confirmed.
- Re-run a scan after the change and record the date, so you can show the exposure is closed.
Why it matters
Command injection means a value sent to the device ends up inside a command that the operating system runs. If the value is not checked or escaped, the caller can add their own instructions. On a router, that code runs with the rights of the web service, which is often high.
Consumer and small office routers are a hard case for defenders. Many are never updated, many sit directly on the internet, and the same CGI program often handles dozens of settings. A flaw in one handler is frequently a sign of others, which is why this CVE has siblings in the same file.
The CVSS vector reads as follows. The attack is possible over the network, attack complexity is low, privileges required are none, and user interaction is not needed. The impact on confidentiality, integrity and availability is limited, limited and limited respectively. A score is a starting point. Your own exposure, meaning whether the product faces the internet and what it can reach, decides the real priority.
Quick check
Is this vulnerability known to be exploited in the wild?
The record's KEV flag is false, so CISA does not list it in the Known Exploited Vulnerabilities catalog. The description says an exploit has been disclosed to the public, which is not the same as confirmed attacks. Treat the public disclosure as a reason to act sooner.
Which versions are fixed?
The record does not confirm a fixed version, and the vendor reference could not be retrieved. Check the vendor or project page, and if none is available, restrict access to the product or replace it.
Sources
The vendor and researcher references listed in the NVD record could not be retrieved when this post was written, so the details above come from the NVD record itself.
Last reviewed: 19 October 2026.
