PT-2024-27683 · Totolink · Totolink X6000R

Lakemoon602 · Published 2024-06-20 · Updated 2024-07-03 · CVE-2024-37626

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A6000R version 1.0.1-B20201211.2000

Description A command injection issue allows a remote attacker to execute arbitrary code via the iface parameter in the vif enable function. This enables the attacker to inject and execute commands, potentially leading to unauthorized access or control of the system.

Recommendations For TOTOLINK A6000R version 1.0.1-B20201211.2000, consider disabling the vif enable function until a patch is available to prevent exploitation of the command injection issue. Restrict access to the iface parameter to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-37626

Affected Products

Totolink X6000R

References · 7

• 🔥 https://github.com/lakemoon602/vuln/blob/main/totolink/TOTOlink%20A6000R%20vif_enable.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-37626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37626 · Security Note
• https://totolink.net · Note
• https://twitter.com/CVEnew/status/1803842138976723090 · Twitter Post
• http://a6000r.com · Note
• https://t.me/cvenotify/83887 · Telegram Post