CVE-2024-7336
Last modified
CVE-2024-7336 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi. EPSS estimates a 1.27% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273259. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Totolink | Ex200 Firmware | 4.0.3c.7646_b20201211 |
References
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/EX200/loginauth.mdExploit, Technical Description, Third Party Advisory
- https://vuldb.com/?ctiid.273259Permissions Required, VDB Entry
- https://vuldb.com/?id.273259Permissions Required, VDB Entry
- https://vuldb.com/?submit.379314Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-7336?
How severe is CVE-2024-7336?
How do I fix CVE-2024-7336?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-7330A vulnerability has been found in YouDianCMS 7 and classifie…6.3
- CVE-2024-7331A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B2…8.8
- CVE-2024-7332A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B201…9.8
- CVE-2024-7333A vulnerability was found in TOTOLINK N350RT 9.3.5u.6139_B20…8.8
- CVE-2024-7334A vulnerability was found in TOTOLINK EX1200L 9.3.5u.6146_B2…8.8
- CVE-2024-7335A vulnerability classified as critical has been found in TOT…8.8
- CVE-2024-7337A vulnerability, which was classified as critical, has been …8.8
- CVE-2024-7338A vulnerability, which was classified as critical, was found…8.8
- CVE-2024-7339A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR …5.3
- CVE-2024-7340The Weave server API allows remote users to fetch files from…8.8
- CVE-2024-7341A session fixation issue was discovered in the SAML adapters…7.1
- CVE-2024-7342A vulnerability was found in Baidu UEditor 1.4.3.3. It has b…6.1
Are you affected by CVE-2024-7336?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST