CVE-2024-7337

A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by this issue is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273260. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
References
Link Resource
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX1200/loginauth.md Exploit Technical Description Third Party Advisory
https://vuldb.com/?ctiid.273260 Permissions Required VDB Entry
https://vuldb.com/?id.273260 Permissions Required VDB Entry
https://vuldb.com/?submit.379315 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:totolink:ex1200l_firmware:9.3.5u.6146_b20201023:*:*:*:*:*:*:*
cpe:2.3:h:totolink:ex1200l:-:*:*:*:*:*:*:*

History

09 Aug 2024, 14:15

Type Values Removed Values Added
CPE cpe:2.3:o:totolink:ex1200l_firmware:9.3.5u.6146_b20201023:*:*:*:*:*:*:*
cpe:2.3:h:totolink:ex1200l:-:*:*:*:*:*:*:*
References () https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX1200/loginauth.md - () https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX1200/loginauth.md - Exploit, Technical Description, Third Party Advisory
References () https://vuldb.com/?ctiid.273260 - () https://vuldb.com/?ctiid.273260 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.273260 - () https://vuldb.com/?id.273260 - Permissions Required, VDB Entry
References () https://vuldb.com/?submit.379315 - () https://vuldb.com/?submit.379315 - Third Party Advisory, VDB Entry
First Time Totolink ex1200l
Totolink
Totolink ex1200l Firmware

01 Aug 2024, 12:42

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en TOTOLINK EX1200L 9.3.5u.6146_B20201023 y clasificada como crítica. La función loginauth del archivo /cgi-bin/cstecgi.cgi es afectada por esta vulnerabilidad. La manipulación del argumento http_host provoca un desbordamiento de búfer. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-273260. NOTA: Se contactó al proveedor tempranamente sobre esta divulgación, pero no respondió de ninguna manera.

01 Aug 2024, 03:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-01 03:15

Updated : 2024-08-09 14:15


NVD link : CVE-2024-7337

Mitre link : CVE-2024-7337

CVE.ORG link : CVE-2024-7337


JSON object : View

Products Affected

totolink

  • ex1200l_firmware
  • ex1200l
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')