PT-2024-19470 · Totolink · Totolink X2000R V2

Published 2024-01-25 · Updated 2024-01-31 · CVE-2024-22529

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK X2000R V2 version V2.0.0-B20230727.10434

Description The issue is a command injection vulnerability in the sub 449040, which is the handle function of formUploadFile, located in /bin/boa. This vulnerability can be exploited through the "formUploadFile" functionality.

Recommendations For TOTOLINK X2000R V2 version V2.0.0-B20230727.10434, as a temporary workaround, consider disabling the sub 449040 function until a patch is available. Restrict access to the /bin/boa module to minimize the risk of exploitation. Avoid using the formUploadFile functionality in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-22529

Affected Products

Totolink X2000R V2

References · 6

• 🔥 https://github.com/unpWn4bL3/iot-security/blob/main/29.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-22529 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22529 · Vendor Advisory
• https://twitter.com/CVEnew/status/1750543578080977390 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1750570957264060711 · Twitter Post
• https://t.me/cvenotify/68697 · Telegram Post