PT-2024-1062 · Totolink · Totolink N350Rt

Jylsec · Published 2024-01-08 · Updated 2024-05-17 · CVE-2023-7218

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink N350RT version 9.3.5u.6139 B202012

Description The issue is related to a stack-based buffer overflow in the loginAuth function of the /cgi-bin/cstecgi.cgi file, which can be exploited remotely. This is due to the manipulation of the password argument. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For Totolink N350RT version 9.3.5u.6139 B202012, as a temporary workaround, consider disabling the loginAuth function until a patch is available. Restrict access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation. Avoid using the password argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2024-00293

CVE-2023-7218

Affected Products

Totolink N350Rt

References · 8

• 🔥❌ https://github.com/jylsec/vuldb/blob/main/TOTOLINK/N350RT/4/README.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-7218 · Security Note
• https://bdu.fstec.ru/vul/2024-00293 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7218 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1744506260211327372 · Twitter Post
• https://twitter.com/CVEnew/status/1744470237314212040 · Twitter Post
• https://vuldb.com/?id.249852 · Note
• https://vuldb.com/?ctiid.249852 · Note