TOTOLINK CA300-PoE 命令注入漏洞

The TOTOLINK CA300-PoE is a wireless access point from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK CA300-PoE version V6.2c.884, which originates from a command injection issue in the hosttime parameter of the NTPSyncWithHost method...

PT-2023-19435 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A command injection issue was discovered via the minute parameter in the setRebootScheCfg function. This allows for potential command injection attacks. Recommendations: For TOTOLINK CA300-PoE...

TOTOLINK CA300-PoE 命令注入漏洞

The TOTOLINK CA300-PoE is a wireless access point from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK CA300-PoE version V6.2c.884, which is caused by a command injection issue in the minute parameter of the setRebootScheCfg method...

CVE-2023-24146

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function...

CVE-2023-24141

CVE-2023-24141 affects TOTOLINK CA300-PoE (V6.2c.884). The vulnerability is a command injection via the NetDiagPingTimeOut parameter in the setNetworkDiag function. CVSS 3.1 scores indicate a network-accessible, high-severity issue with no user interaction and no privileges required, with impacts...

CVE-2023-24148

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function...

CVE-2023-24148

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function...

CVE-2023-24138

The CVE-2023-24138 entry concerns TOTOLINK CA300-PoE with firmware V6.2c.884. The vulnerability is a command injection in NTPSyncWithHost via the host_time parameter affecting the NTPSyncWithHost function. Affected component: host_time handling in that function. Impact as per sources: Confidentia...

TOTOLINK CA300-PoE 命令注入漏洞

The TOTOLINK CA300-PoE is a wireless access point from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK CA300-PoE version V6.2c.884 due to a command injection issue in the pluginversion parameter of the setUnloadUserData method...

CVE-2023-24141

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function...

TOTOLINK CA300-PoE 信任管理问题漏洞

The TOTOLINK CA300-PoE is a wireless access point from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK CA300-PoE version V6.2c.884, which originates from /etc/config/product.ini storing the password for the telnet service...

CVE-2023-24140

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function...

CVE-2023-24149

CVE-2023-24149 affects TOTOLINK CA300-PoE, firmware version V6.2c.884, where a hard-coded root password is stored in /etc/shadow. The exposed credential leads to total impact on confidentiality, integrity, and availability (CVSS v3.1: 9.8, NETWORK attack vector, no user interaction; privileges re...

CVE-2023-24145

Vulnerability: TOTOLINK CA300-PoE firmware v6.2c.884 exposes a command‑injection flaw in setUnloadUserData via the plugin_version parameter. Impact: remote code execution over the network with high severity (CVSS 3.1: 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Root cause: improper handling of plu...

CVE-2023-24140

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function...

CVE-2023-24146

The CVE-2023-24146 affects TOTOLINK CA300-PoE v6.2c.884. A command injection vulnerability exists in the minute parameter of the setRebootScheCfg function, allowing potentially arbitrary commands to be executed. Public data credits a PoC/exploitation entry and the NVD/CNA metrics assign a high im...

CVE-2023-24148

The CVE-2023-24148 entry applies to TOTOLINK CA300-PoE, firmware version V6.2c.884, which contains a command-injection vulnerability in the FileName parameter of the setUploadUserData function. The issue is documented across multiple sources (NVD/Red Hat/CNNVD and others) with a CVSS v3.1 base sc...

CVE-2023-24143

CVE-2023-24143 affects TOTOLINK CA300-PoE (V6.2c.884). A command injection vulnerability exists in the NetDiagTracertHop parameter of the setNetworkDiag function. The CVSS v3.1 base score is 9.8 (CRITICAL) with network access, no authentication, no user interaction required, and impacts to confid...

CVE-2023-24138

TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hosttime parameter in the NTPSyncWithHost function...

TOTOLINK CA300-PoE 命令注入漏洞

The TOTOLINK CA300-PoE is a wireless access point from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK CA300-PoE version V6.2c.884, which is caused by a command injection issue in the NetDiagTracertHop parameter of the setNetworkDiag method...