Lucene search

VulDBCVE-2024-7183

HistoryJul 29, 2024 - 5:15 a.m.

CVE-2024-7183

2024-07-2905:15:01

CWE-120

VulDB

web.nvd.nist.gov

totolink a3600r

buffer overflow

remote attack

vdb-272604

public exploit

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

30.2%

JSON

A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272604. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected configurations

Nvd

Node

totolinka3600r_firmwareMatch4.1.2cu.5182_b20201102

AND

totolinka3600rMatch-

VendorProductVersionCPE
totolinka3600r_firmware4.1.2cu.5182_b20201102cpe:2.3:o:totolink:a3600r_firmware:4.1.2cu.5182_b20201102:*:*:*:*:*:*:*
totolinka3600r-cpe:2.3:h:totolink:a3600r:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
totolink	a3600r_firmware	4.1.2cu.5182_b20201102	cpe:2.3:o:totolink:a3600r_firmware:4.1.2cu.5182_b20201102:::::::*
totolink	a3600r	-	cpe:2.3:h:totolink:a3600r:-:::::::*

CNA Affected

[
  {
    "vendor": "TOTOLINK",
    "product": "A3600R",
    "versions": [
      {
        "version": "4.1.2cu.5182_B20201102",
        "status": "affected"
      }
    ]
  }
]

References

github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setUploadSetting.md

vuldb.com/?ctiid.272604

vuldb.com/?id.272604

vuldb.com/?submit.378052

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

30.2%

JSON

Related for CVE-2024-7183