PT-2024-1582 · Totolink · Totolink T6

Lin7Lic · Published 2024-01-09 · Updated 2024-05-17 · CVE-2023-7223

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Totolink T6 version 4.1.9cu.5241 B20210923

Description A vulnerability has been found in the Totolink T6, affecting an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the topicurl argument with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This issue is related to insufficient access control in the mesh system's software.

Recommendations For Totolink T6 version 4.1.9cu.5241 B20210923, as a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file until a patch is available. Avoid using the topicurl argument with the input showSyslog in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2024-01144

CVE-2023-7223

Affected Products

Totolink T6

References · 10

• 🔥 https://drive.google.com/file/d/1puSOo5XrzMrctw7EtrE7DnfssOOuhRTS/view?usp=sharing · Exploit
• https://bdu.fstec.ru/vul/2024-01144 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7223 · Security Note
• https://t.me/cvenotify/67190 · Telegram Post
• https://vuldb.com/?ctiid.249867 · Note
• https://twitter.com/VulmonFeeds/status/1744775761892872293 · Twitter Post
• https://vuldb.com/?id.249867 · Note
• https://twitter.com/CVEnew/status/1744745845105348798 · Twitter Post
• https://t.me/cvenotify/66772 · Telegram Post