PT-2024-22418 · Totolink · Totolink X2000R

Published 2024-03-12 · Updated 2025-03-10 · CVE-2024-28401

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK X2000R versions prior to v1.0.0-B20231213.1013

Description The issue is related to a Store Cross-site scripting (XSS) vulnerability in the Root Access Control under the Wireless Page. This vulnerability can be exploited to execute malicious scripts on the device.

Recommendations For versions prior to v1.0.0-B20231213.1013, update to version v1.0.0-B20231213.1013 or later to resolve the issue. As a temporary workaround, consider restricting access to the Root Access Control under the Wireless Page until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-05053

CVE-2024-28401

Affected Products

Totolink X2000R

References · 10

• 🔥 https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_1_Root_Access_Control/XSS.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-28401 · Security Note
• https://bdu.fstec.ru/vul/2025-05053 · Security Note
• https://osv.dev/vulnerability/CVE-2024-28401 · Vendor Advisory
• https://t.me/cvenotify/114070 · Telegram Post
• https://t.me/cvenotify/73979 · Telegram Post
• https://t.me/cvenotify/74082 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1768707256101535890 · Twitter Post
• https://totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html · Note
• https://twitter.com/CVEnew/status/1768678271246352727 · Twitter Post