PT-2024-39287 · Totolink · Totolink A720R

Cl0Wnk1N9 · Published 2024-09-14 · Updated 2024-09-20 · CVE-2024-8869

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TOTOLINK A720R version 4.1.5

Description: A critical vulnerability has been found, affecting the exportOvpn function, which leads to os command injection. The attack can be launched remotely, with a rather high complexity and difficult exploitability. The vendor was contacted about this disclosure but did not respond. There have been reports of offensive activities targeting this vulnerability.

Recommendations: For TOTOLINK A720R version 4.1.5, as a temporary workaround, consider disabling the exportOvpn function until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-8869

Affected Products

Totolink A720R

References · 13

• https://osv.dev/vulnerability/CVE-2024-8869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8869 · Security Note
• https://t.me/cvenotify/94673 · Telegram Post
• https://t.me/cvenotify/95471 · Telegram Post
• https://twitter.com/oktsec/status/1835049445001490584 · Twitter Post
• https://vuldb.com/?ctiid.277506 · Note
• https://t.me/cvedetector/5696 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1835296664430448941 · Twitter Post
• https://twitter.com/vuldb/status/1835508036246651204 · Twitter Post
• https://totolink.net · Note
• https://twitter.com/CVEnew/status/1835270226407023068 · Twitter Post
• https://vuldb.com/?submit.403211 · Note
• https://vuldb.com/?id.277506 · Note