cbcvebase.
CVE-2024-7332
published 2024-08-01

CVE-2024-7332: A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file…

PriorityP178critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
20.74%
97.3th percentile
A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273255. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

2 ranges
VendorProductVersion rangeFixed in
totolinkcp450——
totolinkcp450_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/web_cste/cgi-bin/product.ini↗
url{{BaseURL}}/web_cste/cgi-bin/product.ini↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink CP450 Information Disclosure via product.ini (CVE-2024-7332)"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:29; content:"/web_cste/cgi-bin/product.ini"; fast_pattern; reference:url,github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7332.yaml; reference:cve,2024-7332; classtype:attempted-recon; sid:2056216; rev:1; metadata:affected_product TOTOLINK, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_09_27, cve CVE_2024_7332, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_09_27, mitre_tactic_id TA0007, mitre_tactic_name Discovery, mitre_technique_id T1082, mitre_technique_name System_Information_Discovery; target:dest_ip;)
  • →HTTP GET request to /web_cste/cgi-bin/product.ini with a URI byte size of exactly 29 bytes is the attack pattern; no authentication required. ↗
  • →A successful exploitation response body will contain all three strings: [PRODUCT], [WLAN], and HostName — use these as response-body indicators to confirm credential disclosure. ↗
  • →The attack is unauthenticated, remote, and targets plaintext HTTP (tls_state: plaintext); monitor perimeter and internal HTTP traffic for GET requests to this path. ↗
  • →FOFA query 'title="totolink"' can be used to identify exposed TOTOLINK devices for asset discovery and attack surface reduction. ↗
  • ·The vulnerability is specific to firmware version 4.1.0cu.747_B20191224 on the TOTOLINK CP450; other firmware versions are not confirmed affected. ↗
  • ·The hard-coded credentials are exposed via an unauthenticated HTTP GET to product.ini and enable Telnet service access with administrative privileges; Telnet (typically port 23) should be blocked at the network perimeter.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.