PT-2024-38273 · Totolink · Totolink Cp450

Yhryhryhr_Miemie · Published 2024-08-01 · Updated 2024-08-13 · CVE-2024-7332

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK CP450 version 4.1.0cu.747 B20191224

Description A critical issue has been found, affecting the Telnet Service component, specifically an unknown part of the file /web cste/cgi-bin/product.ini. The manipulation leads to the use of a hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Cybersecurity experts are closely monitoring this issue, and it poses a high risk of exploitation.

Recommendations For TOTOLINK CP450 version 4.1.0cu.747 B20191224, as a temporary workaround, consider disabling the Telnet Service until a patch is available. Restrict access to the /web cste/cgi-bin/product.ini file to minimize the risk of exploitation. Avoid using hard-coded passwords in the affected component. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

Related Identifiers

CVE-2024-7332

Affected Products

Totolink Cp450

References · 10

• 🔥 https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP450/product.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7332 · Security Note
• https://vuldb.com/?ctiid.273255 · Note
• https://vuldb.com/?id.273255 · Note
• https://t.me/cvenotify/88141 · Telegram Post
• https://t.me/cvedetector/2195 · Telegram Post
• https://twitter.com/SecAideInfo/status/1822939328789819818 · Twitter Post
• https://twitter.com/SecAideInfo/status/1823301810255483195 · Twitter Post
• https://vuldb.com/?submit.378357 · Note