Sign-up

ID

VAR-202312-1108


CVE

CVE-2023-51024


TITLE

TOTOLINK EX1800T setNtpCfg interface command execution vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-21656

DESCRIPTION

TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi. TOTOLINK EX1800T is a Wi-Fi range extender from China's TOTOLINK Electronics. The vulnerability is caused by the tz parameter of the setNtpCfg interface of cstecgi.cgi failing to properly filter special characters and commands in the constructed command. An attacker can exploit this vulnerability to execute arbitrary commands on the system

Trust: 1.44

sources: NVD: CVE-2023-51024 // CNVD: CNVD-2024-21656

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-21656

AFFECTED PRODUCTS

vendor:totolinkmodel:ex1800tscope:eqversion:9.1.0cu.2112_b20220316

Trust: 1.0

vendor:totolinkmodel:ex1800t v9.1.0cu.2112 b20220316scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2024-21656 // NVD: CVE-2023-51024

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-51024
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2024-21656
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-21656
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2023-51024
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2024-21656 // NVD: CVE-2023-51024

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: NVD: CVE-2023-51024

EXTERNAL IDS

db:NVDid:CVE-2023-51024

Trust: 1.6

db:CNVDid:CNVD-2024-21656

Trust: 0.6

sources: CNVD: CNVD-2024-21656 // NVD: CVE-2023-51024

REFERENCES

url:https://815yang.github.io/2023/12/11/ex1800t/2/totolinkex1800t_v9.1.0cu.2112_b2022031setntpcfg-tz/

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2023-51024

Trust: 0.6

sources: CNVD: CNVD-2024-21656 // NVD: CVE-2023-51024

SOURCES

db:CNVDid:CNVD-2024-21656
db:NVDid:CVE-2023-51024

LAST UPDATE DATE

2024-08-14T13:52:01.797000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-21656date:2024-05-08T00:00:00
db:NVDid:CVE-2023-51024date:2023-12-27T21:11:05.060

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-21656date:2024-05-10T00:00:00
db:NVDid:CVE-2023-51024date:2023-12-22T18:15:07.820