PT-2024-5934 · Totolink · Totolink Ac1200 Wireless Router
Swind1Er
·
Published
2024-08-28
·
Updated
2025-07-03
·
CVE-2024-34198
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
TOTOLINK AC1200 Wireless Router A3002RU version V2.1.1-B20230720.1011
Description
The issue concerns a buffer overflow vulnerability related to the formWlEncrypt CGI handler in the boa program. This handler fails to limit the length of the
wlan ssid field from user input, allowing attackers to craft malicious HTTP requests by supplying an excessively long value for the wlan ssid field. This can lead to a stack overflow and potentially be exploited further to execute arbitrary commands or launch denial-of-service attacks.Recommendations
As a temporary workaround, consider disabling the
formWlEncrypt CGI handler in the boa program until a patch is available. Restrict access to the vulnerable boa program to minimize the risk of exploitation. Avoid using the wlan ssid field in affected HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Totolink Ac1200 Wireless Router