PT-2024-8116 · Totolink · Totolink X6000R

Yanggao017 · Published 2024-07-18 · Updated 2024-08-01 · CVE-2024-41314

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: TOTOLINK A6000R version V1.0.1-B20201211.2000

Description: A command injection issue exists due to the lack of neutralization of special elements used in the operating system command. This issue is related to the vif disable function and can be exploited via the iface parameter, allowing a remote attacker to execute arbitrary commands.

Recommendations: For TOTOLINK A6000R version V1.0.1-B20201211.2000, consider disabling the vif disable function as a temporary workaround until a patch is available. Restrict access to the iface parameter in the affected function to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-09646

CVE-2024-41314

Affected Products

Totolink X6000R

References · 7

• 🔥 https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_1_vif_disable/README.md · Exploit
• https://bdu.fstec.ru/vul/2024-09646 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41314 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41314 · Security Note
• https://t.me/cvenotify/87127 · Telegram Post
• https://t.me/cvedetector/1441 · Telegram Post
• https://gist.github.com/yanggao017/8593748d4e2de1582344b4035b2456c6 · Note