CVE-2023-24150: Totolink t8 Firmware

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.

Affected products

• Totolink t8 Firmware: version v4.1.5cu only

Published 2023-02-03. Last modified 2026-06-17.