PT-2024-25254 · Totolink · Totolink X2000R

Published 2024-05-13 · Updated 2024-08-01 · CVE-2024-33433

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK X2000R versions prior to v1.0.0-B20231213.1013

Description The issue allows a remote attacker to execute arbitrary code via the Guest Access Control parameter in the "Wireless Page" API endpoint. This enables the attacker to perform unauthorized actions on the affected system.

Recommendations For versions prior to v1.0.0-B20231213.1013, update to version v1.0.0-B20231213.1013 or later to resolve the issue. As a temporary workaround, consider restricting access to the Wireless Page or disabling the Guest Access Control parameter to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-233

Related Identifiers

CVE-2024-33433

Affected Products

Totolink X2000R

References · 3

• 🔥 https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/X2000R/XSS_2_Guest_Access_Control/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-33433 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33433 · Vendor Advisory