Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-7332

A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Published

2024-08-01T01:15:09.663

Last Modified

2024-08-09T13:55:52.587

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Secondary
CWE-259
Type: Primary
CWE-798

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	totolink	cp450_firmware	4.1.0cu.747_b20191224	Yes
Hardware	totolink	cp450	-	No

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP450/product.md Exploit, Technical Description, Third Party Advisory ([email protected])
https://vuldb.com/?ctiid.273255 Permissions Required, VDB Entry ([email protected])
https://vuldb.com/?id.273255 Permissions Required, VDB Entry ([email protected])
https://vuldb.com/?submit.378357 Third Party Advisory, VDB Entry ([email protected])