CVE-2024-1661

A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254179. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-798

• https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-Totolink/X6000R-Hardcoded-Password.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.254179Permissions Required
• https://vuldb.com/?id.254179Third Party Advisory
• https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-Totolink/X6000R-Hardcoded-Password.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.254179Permissions Required
• https://vuldb.com/?id.254179Third Party Advisory

Published

Feb 20, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1655Certain ASUS WiFi routers models has an OS Command Injection…8.8
• CVE-2024-1656Affected versions of Octopus Server had a weak content secur…2.6
• CVE-2024-1657A flaw was found in the ansible automation platform. An inse…8.1
• CVE-2024-1658The Grid Shortcodes WordPress plugin before 1.1.1 does not v…5.4
• CVE-2024-1659Arbitrary File Upload vulnerability in MegaBIP software allo…9.8
• CVE-2024-1660The Top Bar WordPress plugin before 3.0.5 does not sanitise …4.8
• CVE-2024-1662Missing Authentication for Critical Function, Missing Author…7.5
• CVE-2024-1663The Ultimate Noindex Nofollow Tool II WordPress plugin befor…4.8
• CVE-2024-1664The Responsive Gallery Grid WordPress plugin before 2.3.11 d…6.1
• CVE-2024-1665Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-1666In lunary-ai/lunary version 1.0.0, an authorization flaw exi…5.3
• CVE-2024-1668The Avada | Website Builder For WordPress & WooCommerce them…6.5