PT-2024-38117 · Totolink · Totolink A3300R

Yhryhryhr_Tu · Published 2024-07-28 · Updated 2024-08-08 · CVE-2024-7155

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version 17.0.0cu.557 B20221024

Description A vulnerability has been found in the affected software, classified as problematic. It affects an unknown functionality of the file /etc/shadow.sample, leading to the use of a hard-coded password. The attack can be launched on the local host, with a rather high complexity and difficult exploitation. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond.

Recommendations For version 17.0.0cu.557 B20221024, as a temporary workaround, consider restricting access to the file /etc/shadow.sample until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

CVE-2024-7155

Affected Products

Totolink A3300R

References · 9

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3300R/shadow.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7155 · Security Note
• https://t.me/cvenotify/87661 · Telegram Post
• https://t.me/cvenotify/89898 · Telegram Post
• https://t.me/cvedetector/1769 · Telegram Post
• https://vuldb.com/?submit.377465 · Note
• https://vuldb.com/?ctiid.272569 · Note
• https://vuldb.com/?id.272569 · Note