CVE-2024-35397 identifies a command injection vulnerability in TOTOLINK CP900L version 4.1.5cu.798_B20221228. The issue exists in the NTPSyncWithHost function, where the hostTime parameter is improperly sanitized, enabling remote attackers to execute arbitrary system commands without authentication. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full compromise of the device, including unauthorized access, data manipulation, and denial of service. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device, especially from untrusted networks, to reduce exposure. Monitor for unusual activity related to NTP synchronization requests. Avoid exposing the device management interface to the internet.