CVE-2024-0299

CWE-78 — OS Command Injection3 documents3 sources
Severity
9.8CRITICAL
EPSS
2.1%
top 16.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink N200reTotolink N200re Firmware
Timeline
PublishedJan 8

Description

A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249865 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5totolink/n200re9.3.5u.6139_B20201216
▶NVDtotolink/n200re_firmware9.3.5u.6139_b20201216

🔴Vulnerability Details

2
CVEList
Totolink N200RE cstecgi.cgi setTracerouteCfg os command injection↗2024-01-08
▶
GHSA
GHSA-h52q-mc3p-44c8: A vulnerability was found in Totolink N200RE 9↗2024-01-08
▶
CVE-2024-0299 (CRITICAL CVSS 9.8) | A vulnerability was found in Totoli | cvebase.io