PT-2024-38121 · Totolink · Totolink A3600R

Wxhwxhwxh_Mie · Published 2024-07-28 · Updated 2024-08-08 · CVE-2024-7159

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A3600R version 4.1.2cu.5182 B20201102

Description A critical issue affects the Telnet Service component, specifically the processing of the file /web cste/cgi-bin/product.ini. This manipulation leads to the use of a hard-coded password. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond.

Recommendations For TOTOLINK A3600R version 4.1.2cu.5182 B20201102, consider disabling the Telnet Service as a temporary workaround until a patch is available. Restrict access to the /web cste/cgi-bin/product.ini file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2024-7159

Affected Products

Totolink A3600R

References · 9

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/product.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7159 · Security Note
• https://vuldb.com/?ctiid.272573 · Note
• https://t.me/cvedetector/1775 · Telegram Post
• https://vuldb.com/?id.272573 · Note
• https://t.me/cvenotify/89902 · Telegram Post
• https://t.me/cvenotify/87671 · Telegram Post
• https://vuldb.com/?submit.377942 · Note