CVE-2024-35401 identifies a command injection vulnerability in TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228. The flaw exists in the UploadFirmwareFile function where the FileName parameter is not properly sanitized, allowing an attacker to inject and execute arbitrary commands. The vulnerability requires local access (AV:L) and no privileges (PR:N) or user interaction (UI:N) are needed. The impact includes limited confidentiality, integrity, and availability loss (C:L/I:L/A:L). No known exploits in the wild or vendor patches have been reported as of the publication date.

Successful exploitation could allow an attacker with local access to execute arbitrary commands on the affected device, potentially leading to limited compromise of confidentiality, integrity, and availability. The vulnerability does not require user interaction or privileges, but local access is necessary. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to the device and monitor for suspicious activity related to firmware upload functionality. Avoid uploading firmware files from untrusted sources.