PT-2025-6883 · Totolink · Totolink X18
Hello Vuldb
+1
·
Publicado
2025-02-16
·
Atualizado
2025-02-17
·
CVE-2025-1340
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
TOTOLINK X18 version 9.1.0cu.2024 B20220329
Description:
A critical vulnerability has been found in the
setPasswordCfg function of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to a stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.Recommendations:
As a temporary workaround, consider disabling the
setPasswordCfg function until a patch is available. Restrict access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation. Avoid using the String parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Stack Overflow
Memory Corruption
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Totolink X18