PT-2024-10236 · Totolink · Totolink A810R

Published 2024-12-09 · Updated 2025-01-21 · CVE-2024-57036

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK A810R version 4.1.2cu.5032 B20200407

Description A command insertion vulnerability was discovered in the downloadFile.cgi main function. This issue allows an attacker to execute arbitrary commands by sending a specially crafted HTTP request. The vulnerability is related to the failure to neutralize special elements, such as operating system commands.

Recommendations For TOTOLINK A810R version 4.1.2cu.5032 B20200407, consider disabling the downloadFile.cgi function until a patch is available to prevent exploitation. Restrict access to the downloadFile.cgi endpoint to minimize the risk of arbitrary command execution. Avoid using the vulnerable function to download files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2025-00612

CVE-2024-57036

Affected Products

Totolink A810R

References · 6

• 🔥 https://github.com/luckysmallbird/Totolink-A810R-Vulnerability-1/blob/main/3.md · Exploit
• https://bdu.fstec.ru/vul/2025-00612 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57036 · Security Note
• https://twitter.com/CVEnew/status/1881737633044271376 · Twitter Post
• https://t.me/cvedetector/15976 · Telegram Post