CVE-2023-6906

🗓️ 18 Dec 2023 00:00:07Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 41 Views🌐 WEB

A critical buffer overflow vulnerability in Totolink A7100RU 7.4cu.2313_B20191024 allows remote attackers to launch an exploit via the /cgi-bin/cstecgi.cgi?action=login HTTP POST Request Handler, leading to the manipulation of the argument flag with the input ie8

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-6906	12 Jan 202406:56	–	circl
CNNVD	Totolink A7100RU 安全漏洞	18 Dec 202300:00	–	cnnvd
CNVD	Totolink A7100RU Buffer Overflow Vulnerability	20 Dec 202300:00	–	cnvd
Cvelist	CVE-2023-6906 Totolink A7100RU HTTP POST Request main buffer overflow	18 Dec 202300:00	–	cvelist
EUVD	EUVD-2023-59107	3 Oct 202520:07	–	euvd
NVD	CVE-2023-6906	18 Dec 202304:15	–	nvd
OSV	CVE-2023-6906	18 Dec 202304:15	–	osv
Prion	Buffer overflow	18 Dec 202304:15	–	prion
RedhatCVE	CVE-2023-6906	23 May 202502:04	–	redhatcve
Vulnrichment	CVE-2023-6906 Totolink A7100RU HTTP POST Request main buffer overflow	18 Dec 202300:00	–	vulnrichment

NVD

Node

totolink a7100ru_firmwareMatch7.4cu.2313_b20191024

AND

totolink a7100ruMatch-

[
  {
    "vendor": "Totolink",
    "product": "A7100RU",
    "versions": [
      {
        "version": "7.4cu.2313_B20191024",
        "status": "affected"
      }
    ],
    "modules": [
      "HTTP POST Request Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
github	www.github.com/unpWn4bL3/iot-security/blob/main/1.md
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
flag	request body	/cgi-bin/cstecgi.cgi?action=login	Buffer overflow in main function due to manipulation of 'flag' parameter in POST request handling, allowing remote exploit.	CWE-120

21 Nov 2024 08:44Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 210

CVSS 39.8

EPSS0.00193

SSVC

CWE-120