Lucene search

MitreCVE-2024-41319

HistoryJul 23, 2024 - 3:15 p.m.

CVE-2024-41319

2024-07-2315:15:05

CWE-77

mitre

web.nvd.nist.gov

totolink a6000r

command injection

vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.005

Percentile

75.7%

JSON

TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the cmd parameter in the webcmd function.

Affected configurations

Nvd

Node

totolinka6000r_firmwareMatch1.0.1-b20201211.2000

AND

totolinka6000rMatch-

VendorProductVersionCPE
totolinka6000r_firmware1.0.1-b20201211.2000cpe:2.3:o:totolink:a6000r_firmware:1.0.1-b20201211.2000:*:*:*:*:*:*:*
totolinka6000r-cpe:2.3:h:totolink:a6000r:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
totolink	a6000r_firmware	1.0.1-b20201211.2000	cpe:2.3:o:totolink:a6000r_firmware:1.0.1-b20201211.2000:::::::*
totolink	a6000r	-	cpe:2.3:h:totolink:a6000r:-:::::::*

References

gist.github.com/yanggao017/40efb889800ae2691c38086ebf80c037

github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_7_webcmd/README.md

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.005

Percentile

75.7%

JSON

Related for CVE-2024-41319