PT-2024-5478 · Totolink · Totolink N350Rt

2705056589 · Published 2024-07-23 · Updated 2024-08-09 · CVE-2024-7333

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK N350RT version 9.3.5u.6139 B20201216

Description A critical issue affects the setParentalRules function of the /cgi-bin/cstecgi.cgi file, causing a buffer overflow when the week, sTime, and eTime parameters are manipulated. This can be exploited remotely, potentially impacting the confidentiality, integrity, and availability of protected information by sending a specially crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The exploit has been publicly disclosed.

Recommendations For TOTOLINK N350RT version 9.3.5u.6139 B20201216, as a temporary workaround, consider disabling the setParentalRules function until a patch is available. Restrict access to the /cgi-bin/cstecgi.cgi endpoint to minimize the risk of exploitation. Avoid using the parameters week, sTime, and eTime in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-06127

CVE-2024-7333

Affected Products

Totolink N350Rt

References · 9

• 🔥 https://github.com/135a/IoT-vulnerable/blob/main/TOTOLINK/N350RT/setParentalRules.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-7333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7333 · Security Note
• https://bdu.fstec.ru/vul/2024-06127 · Security Note
• https://t.me/cvedetector/2197 · Telegram Post
• https://vuldb.com/?ctiid.273256 · Note
• https://vuldb.com/?id.273256 · Note
• https://vuldb.com/?submit.379281 · Note
• https://t.me/cvenotify/88147 · Telegram Post