PT-2024-19653 · Totolink · Totolink A3300R

Yangyi · Published 2024-01-11 · Updated 2024-01-18 · CVE-2024-23061

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version V17.0.0cu.557 B20221024

Description A command injection issue was found via the minute parameter in the setScheduleCfg function. This allows for potential exploitation.

Recommendations For TOTOLINK A3300R version V17.0.0cu.557 B20221024, consider restricting access to the setScheduleCfg function until a patch is available. As a temporary workaround, avoid using the minute parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-23061

Affected Products

Totolink A3300R

References · 5

• 🔥 https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/3/TOTOLINK%20A3300R%20setScheduleCfg.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-23061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23061 · Security Note
• https://twitter.com/CVEnew/status/1745480828598272158 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1745503472240164901 · Twitter Post