PT-2023-9015 · Totolink · Totolink N200Re

Lin7Lic · Publicado 2023-05-18 · Atualizado 2024-05-17 · CVE-2023-2790

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK N200RE version 9.3.5u.6255 B20211224

Description A problematic vulnerability has been found in the Telnet Service component of the TOTOLINK N200RE, affecting an unknown function of the file /squashfs-root/etc ro/custom.conf. The manipulation leads to exposure of passwords in the configuration file. This issue can be exploited locally. The vulnerability is related to the use of an unstable cryptographic algorithm in configuration files, which may allow an attacker to gain unauthorized access to protected information.

Recommendations For TOTOLINK N200RE version 9.3.5u.6255 B20211224, consider disabling the Telnet Service or restricting access to the /squashfs-root/etc ro/custom.conf file as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-260

Identificadores relacionados

BDU:2024-03019

CVE-2023-2790

Produtos afetados

Totolink N200Re

Referências · 7

• 🔥 https://drive.google.com/file/d/1RITXRvKele5aW42YFk0JeQHCq2B63lUj/view?usp=share_link · Exploit
• 🔥 https://vuldb.com/?id.229374 · Exploit
• https://vuldb.com/?ctiid.229374 · Nota
• https://bdu.fstec.ru/vul/2024-03019 · Nota de Segurança
• https://t.me/cibsecurity/64400 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2790 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2790 · Nota de Segurança