CVE-2024-0298

CWE-78 — OS Command Injection3 documents3 sources
Severity
9.8CRITICAL
EPSS
2.1%
top 16.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink N200reTotolink N200re Firmware
Timeline
PublishedJan 8

Description

A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249864. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5totolink/n200re9.3.5u.6139_B20201216
▶NVDtotolink/n200re_firmware9.3.5u.6139_b20201216

🔴Vulnerability Details

2
CVEList
Totolink N200RE cstecgi.cgi setDiagnosisCfg os command injection↗2024-01-08
▶
GHSA
GHSA-p2xj-99fc-824q: A vulnerability was found in Totolink N200RE 9↗2024-01-08
▶
CVE-2024-0298 (CRITICAL CVSS 9.8) | A vulnerability was found in Totoli | cvebase.io