CVE-2024-0297

CWE-78 — OS Command Injection4 documents4 sources
Severity
9.8CRITICAL
EPSS
0.9%
top 24.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink N200reTotolink N200re Firmware
Timeline
PublishedJan 8

Description

A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249863. NOTE: The vendor was contacted early about this disclosure but did not respond in an…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5totolink/n200re9.3.5u.6139_B20201216
▶NVDtotolink/n200re_firmware9.3.5u.6139_b20201216

🔴Vulnerability Details

3
GHSA
GHSA-m8hm-22wv-cf8j: A vulnerability was found in Totolink N200RE 9↗2024-01-08
▶
CVEList
Totolink N200RE cstecgi.cgi UploadFirmwareFile os command injection↗2024-01-08
▶
VulnCheck
totolink n200re_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')↗2024
▶
CVE-2024-0297 (CRITICAL CVSS 9.8) | A vulnerability was found in Totoli | cvebase.io