PT-2024-38116 · Totolink · Totolink A3700R

Yhryhryhr_Tu · Published 2024-07-28 · Updated 2024-08-08 · CVE-2024-7154

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK A3700R version 9.1.2u.5822 B20200513

Description A problematic issue was found in the Password Reset Handler component, specifically in the /wizard.html file, allowing for improper access controls. The manipulation can be launched remotely. The issue has been publicly disclosed and may be exploited.

Recommendations For TOTOLINK A3700R version 9.1.2u.5822 B20200513, consider restricting access to the Password Reset Handler component, specifically the /wizard.html file, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

CVE-2024-7154

Affected Products

Totolink A3700R

References · 9

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3700R/setWizardCfg_changepw.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7154 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7154 · Vendor Advisory
• https://t.me/cvenotify/87660 · Telegram Post
• https://t.me/cvedetector/1770 · Telegram Post
• https://t.me/cvenotify/89903 · Telegram Post
• https://vuldb.com/?id.272568 · Note
• https://vuldb.com/?submit.377463 · Note
• https://vuldb.com/?ctiid.272568 · Note