CVE-2024-0295
Assigner: VulDB
Published: 2024-01-08T03:31:03.718Z
State: PUBLISHED
title: Totolink LR1200GB cstecgi.cgi setWanCfg os command injection
problemTypes: descriptions: type: CWE
cweId: CWE-78
description: CWE-78 OS Command Injection
affected: vendor: Totolink
product: LR1200GB
versions: version: 9.1.0u.6619_B20230130
status: affected
descriptions: value: A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249861 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
value: Es wurde eine kritische Schwachstelle in Totolink LR1200GB 9.1.0u.6619_B20230130 gefunden. Hiervon betroffen ist die Funktion setWanCfg der Datei /cgi-bin/cstecgi.cgi. Durch das Manipulieren des Arguments hostName mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung.
metrics: cvssV3_1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
cvssV3_0: version: 3.0
baseScore: 7.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
cvssV2_0: version: 2.0
baseScore: 7.5
vectorString: AV:N/AC:L/Au:N/C:P/I:P/A:P
timeline: time: 2024-01-07T00:00:00.000Z
value: Advisory disclosed
time: 2024-01-07T00:00:00.000Z
value: CVE reserved
time: 2024-01-07T01:00:00.000Z
value: VulDB entry created
time: 2024-01-25T08:35:57.000Z
value: VulDB entry last update
credits: value: jylsec (VulDB User)
type: reporter