PT-2024-38176 · Totolink · Totolink Lr1200Gb

Yhryhryhr_Miemie · Published 2024-07-30 · Updated 2024-08-06 · CVE-2024-7216

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK LR1200 version 9.3.1cu.2832

Description A problem was found in the file /etc/shadow.sample, which leads to the use of a hard-coded password. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For TOTOLINK LR1200 version 9.3.1cu.2832, consider changing the hard-coded password to a unique and secure one to minimize the risk of exploitation. As a temporary workaround, restrict access to the file /etc/shadow.sample until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2024-7216

Affected Products

Totolink Lr1200Gb

References · 8

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-7216 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7216 · Vendor Advisory
• https://t.me/cvenotify/87860 · Telegram Post
• https://vuldb.com/?id.272787 · Note
• https://vuldb.com/?ctiid.272787 · Note
• https://t.me/cvedetector/1971 · Telegram Post
• https://vuldb.com/?submit.378331 · Note