PT-2024-24223 · Totolink · Totolink Ex200

Published 2024-04-03 · Updated 2025-06-17 · CVE-2024-31815

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK EX200 version 4.0.3c.7314 B20191204

Description An attacker can obtain the configuration file without authorization through the "/cgi-bin/ExportSettings.sh" API endpoint.

Recommendations For TOTOLINK EX200 version 4.0.3c.7314 B20191204, as a temporary workaround, consider restricting access to the "/cgi-bin/ExportSettings.sh" API endpoint until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2025-11316

CVE-2024-31815

Affected Products

Totolink Ex200

References · 10

• 🔥 https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_ExportSettings/Leak.md · Exploit
• 🔥 https://github.com/4hsienyang/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_ExportSettings/Leak.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-31815 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11316 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-31815 · Security Note
• https://t.me/cvenotify/125992 · Telegram Post
• https://twitter.com/CVEnew/status/1777312397465927834 · Twitter Post
• https://t.me/cvenotify/92232 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1777344767849893942 · Twitter Post
• https://t.me/cvenotify/99737 · Telegram Post