A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8 leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248268. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/unpWn4bL3/iot-security/blob/main/1.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.248268 | Permissions Required Third Party Advisory |
| https://vuldb.com/?id.248268 | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
20 Dec 2023, 20:47
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-120 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Totolink a7100ru Firmware
Totolink a7100ru Totolink |
|
| References | () https://vuldb.com/?ctiid.248268 - Permissions Required, Third Party Advisory | |
| References | () https://vuldb.com/?id.248268 - Third Party Advisory | |
| References | () https://github.com/unpWn4bL3/iot-security/blob/main/1.md - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:h:totolink:a7100ru:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:a7100ru_firmware:7.4cu.2313_b20191024:*:*:*:*:*:*:* |
18 Dec 2023, 14:05
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-18 04:15
Updated : 2024-05-17 02:34
NVD link : CVE-2023-6906
Mitre link : CVE-2023-6906
CVE.ORG link : CVE-2023-6906
JSON object : View
Products Affected
totolink
- a7100ru
- a7100ru_firmware
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')