PT-2024-8853 · Totolink+1 · Totolink A600Ub+2

Published 2024-10-14 · Updated 2024-11-18 · CVE-2024-51141

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TOTOLINK Bluetooth Wireless Adapter A600UB (affected versions not specified)

Description: The issue allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components. This is related to incorrect integrity value checking in the MSASN1.dll library of the WifiAutoInstallDriver.exe file in the TOTOLINK A600UB wireless USB adapter's firmware. Exploitation of this issue may enable an attacker to execute arbitrary code.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-354

Related Identifiers

BDU:2024-10494

CVE-2024-51141

Affected Products

Msasn1.Dll

Totolink A600Ub

Wifiautoinstalldriver.Exe

References · 7

• 🔥 https://infosecwriteups.com/dll-hijacking-in-totolink-a600ub-driver-installer-13787c4d97b4 · Exploit
• https://bdu.fstec.ru/vul/2024-10494 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-51141 · Security Note
• https://t.me/cvedetector/11157 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857614864920834307 · Twitter Post
• https://twitter.com/CVEnew/status/1857557174085627987 · Twitter Post
• https://vuldb.com/?id.284843 · Note