PT-2023-22423 · Totolink · Totolink X18

Publicado 2023-04-14 · Atualizado 2023-04-25 · CVE-2023-29802

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version 9.1.0cu.2024 B20220329

Description A command injection issue was found via the ip parameter in the setDiagnosisCfg function. This allows for potential command injection attacks.

Recommendations For TOTOLINK X18 version 9.1.0cu.2024 B20220329, consider restricting access to the setDiagnosisCfg function to minimize the risk of exploitation. Avoid using the ip parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-29802

Produtos afetados

Totolink X18

Referências · 4

• 🔥 https://sore-pail-31b.notion.site/Command-Injection-3-8eb94b608bcd48f8aa4e983d2d1c4526 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-29802 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29802 · Aviso do Fabricante
• https://t.me/cibsecurity/62155 · Publicação no Telegram