CVE-2024-0299
Assigner: VulDB
Published: 2024-01-08T05:31:03.711Z
State: PUBLISHED
title: Totolink N200RE cstecgi.cgi setTracerouteCfg os command injection
problemTypes: descriptions: type: CWE
cweId: CWE-78
description: CWE-78 OS Command Injection
affected: vendor: Totolink
product: N200RE
versions: version: 9.3.5u.6139_B20201216
status: affected
descriptions: value: A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249865 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
value: In Totolink N200RE 9.3.5u.6139_B20201216 wurde eine kritische Schwachstelle ausgemacht. Es geht um die Funktion setTracerouteCfg der Datei /cgi-bin/cstecgi.cgi. Dank der Manipulation des Arguments command mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung.
metrics: cvssV3_1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
cvssV3_0: version: 3.0
baseScore: 7.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
cvssV2_0: version: 2.0
baseScore: 7.5
vectorString: AV:N/AC:L/Au:N/C:P/I:P/A:P
timeline: time: 2024-01-07T00:00:00.000Z
value: Advisory disclosed
time: 2024-01-07T00:00:00.000Z
value: CVE reserved
time: 2024-01-07T01:00:00.000Z
value: VulDB entry created
time: 2024-01-25T09:04:14.000Z
value: VulDB entry last update
credits: value: jylsec (VulDB User)
type: reporter