CVE-2023-36952

2023-10-1605:15:49

CWE-787

[email protected]

web.nvd.nist.gov

totolink cp300+ v5.2cu.7594_b20200910

stack overflow

vulnerability

setdiagnosiscfg

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

48.7%

JSON

TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.

Affected configurations

Nvd

Node

totolinkcp300\+Match-

AND

totolinkcp300\+_firmwareMatch5.2cu.7594_b20200910

VendorProductVersionCPE
totolinkcp300\+-cpe:2.3:h:totolink:cp300\+:-:*:*:*:*:*:*:*
totolinkcp300\+_firmware5.2cu.7594_b20200910cpe:2.3:o:totolink:cp300\+_firmware:5.2cu.7594_b20200910:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
totolink	cp300\+	-	cpe:2.3:h:totolink:cp300\+:-:::::::*
totolink	cp300\+_firmware	5.2cu.7594_b20200910	cpe:2.3:o:totolink:cp300\+_firmware:5.2cu.7594_b20200910:::::::*