PT-2024-2259 · Totolink · Totolink X2000R

Published 2024-03-12 · Updated 2025-03-10 · CVE-2024-28403

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK X2000R versions prior to V1.0.0-B20231213.1013

Description The issue is related to the lack of protection for the web page structure when handling the Comment input field, allowing a remote attacker to conduct cross-site scripting attacks. This can be exploited via the VPN Page.

Recommendations For versions prior to V1.0.0-B20231213.1013, update to version V1.0.0-B20231213.1013 or later to resolve the issue. As a temporary workaround, consider restricting access to the VPN Page to minimize the risk of exploitation. Avoid using the Comment field in the VPN Page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02192

CVE-2024-28403

Affected Products

Totolink X2000R

References · 9

• 🔥 https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_5_VPN/XSS.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-28403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28403 · Security Note
• https://bdu.fstec.ru/vul/2024-02192 · Security Note
• https://t.me/cvenotify/114069 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1768708268304593042 · Twitter Post
• https://t.me/cvenotify/73971 · Telegram Post
• https://totolink.net/home/menu/detail/menu_listtpl/products/id/242/ids/33.html · Note
• https://twitter.com/CVEnew/status/1768673343476060188 · Twitter Post