PT-2024-3093 · Totolink · Totolink Ex200

Published 2024-04-18 · Updated 2024-07-03 · CVE-2024-32325

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK EX200 version 4.0.3c.7646 B20201211

Description The issue is related to a Cross-site scripting (XSS) vulnerability. This vulnerability exists due to inadequate protection of the web page structure in the setWiFiExtenderConfig function. The ssid parameter is specifically mentioned as the vulnerable point. Exploitation of this issue may allow a remote attacker to conduct an XSS attack.

Recommendations For TOTOLINK EX200 version 4.0.3c.7646 B20201211, consider disabling the setWiFiExtenderConfig function or restricting access to the ssid parameter until a patch is available. As a temporary workaround, avoid using the ssid parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-03290

CVE-2024-32325

Affected Products

Totolink Ex200

References · 8

• 🔥 https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/XSS_ssid/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32325 · Security Note
• https://bdu.fstec.ru/vul/2024-03290 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32325 · Vendor Advisory
• https://totolink.net/home/menu/newstpl/menu_newstpl/products/id/144.html · Note
• https://vuldb.com/?id.261524 · Note
• https://twitter.com/CVEnew/status/1781029450324316543 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1781028812752310422 · Twitter Post