CVE-2024-7159

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processing of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier VDB-272573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
ADJACENT_NETWORK
LOW
LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
VulDBCNA
5.5 MEDIUM
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
VendorProductVersion
totolinka3600r_firmware
4.1.2cu.5182_b20201102:cu.5182_b20201102
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/product.md
https://vuldb.com/?ctiid.272573
https://vuldb.com/?id.272573
https://vuldb.com/?submit.377942
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/product.md
https://vuldb.com/?ctiid.272573
https://vuldb.com/?id.272573
https://vuldb.com/?submit.377942