Lucene search

VulDBCVE-2024-7154

HistoryJul 28, 2024 - 10:15 a.m.

CVE-2024-7154

2024-07-2810:15:01

CWE-306

CWE-284

VulDB

web.nvd.nist.gov

vulnerability

totolink a3700r

password reset handler

improper access controls

remote attack

public exploit disclosure

vdb-272568

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.html of the component Password Reset Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272568. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Nvd

Node

totolinka3700r_firmwareMatch9.1.2u.5822_b20200513

AND

totolinka3700rMatch-

VendorProductVersionCPE
totolinka3700r_firmware9.1.2u.5822_b20200513cpe:2.3:o:totolink:a3700r_firmware:9.1.2u.5822_b20200513:*:*:*:*:*:*:*
totolinka3700r-cpe:2.3:h:totolink:a3700r:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
totolink	a3700r_firmware	9.1.2u.5822_b20200513	cpe:2.3:o:totolink:a3700r_firmware:9.1.2u.5822_b20200513:::::::*
totolink	a3700r	-	cpe:2.3:h:totolink:a3700r:-:::::::*

CNA Affected

[
  {
    "vendor": "TOTOLINK",
    "product": "A3700R",
    "versions": [
      {
        "version": "9.1.2u.5822_B20200513",
        "status": "affected"
      }
    ],
    "modules": [
      "Password Reset Handler"
    ]
  }
]

References

github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3700R/setWizardCfg_changepw.md

vuldb.com/?ctiid.272568

vuldb.com/?id.272568

vuldb.com/?submit.377463

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS4

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

24.1%

JSON

Related for CVE-2024-7154