PT-2024-8127 · Totolink · Totolink X6000R

Yanggao017 · Published 2024-07-22 · Updated 2024-08-01 · CVE-2024-41320

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TOTOLINK A6000R version V1.0.1-B20201211.2000

Description: The issue is related to the get apcli conn info function in the TOTOLINK A6000R router's firmware, which fails to neutralize special elements used in an OS command. This can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted command. The vulnerability is specifically related to the ifname parameter in the get apcli conn info function.

Recommendations: For TOTOLINK A6000R version V1.0.1-B20201211.2000, consider disabling the get apcli conn info function until a patch is available to prevent exploitation. Additionally, restrict access to the ifname parameter to minimize the risk of command injection attacks.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-09666

CVE-2024-41320

Affected Products

Totolink X6000R

References · 6

• 🔥 https://github.com/yanggao017/vuln/blob/main/TOTOLINK/A6000R/CI_6_get_apcli_conn_info/README.md · Exploit
• https://bdu.fstec.ru/vul/2024-09666 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41320 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41320 · Vendor Advisory
• https://t.me/cvedetector/1445 · Telegram Post
• https://gist.github.com/yanggao017/081d8638c117e708a4d36783b9230ce5 · Note