CVE-2024-1783

23.02.2024, 01:15

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-254574 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB	CNA	9.8 CRITICAL				CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 53%

Vendor	Product	Version
totolink	lr1200gb_firmware	9.1.0u.6619_b20230130:u.6619_b20230130
totolink	lr1200gb_firmware	9.3.5u.6698_b20230810:u.6698_b20230810

𝑥

= Vulnerable software versions

Known Exploits!

Common Weakness Enumeration

CWE-121 - Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References

https://gist.github.com/manishkumarr1017/30bca574e2f0a6d6336115ba71111984

https://vuldb.com/?ctiid.254574

https://vuldb.com/?id.254574

https://gist.github.com/manishkumarr1017/30bca574e2f0a6d6336115ba71111984

https://vuldb.com/?ctiid.254574

https://vuldb.com/?id.254574