ID
VAR-202401-0183
CVE
CVE-2023-7220
TITLE
Totolink NR1800X buffer overflow vulnerability
Trust: 0.6
DESCRIPTION
A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B20210910 and classified as critical. Affected by this issue is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249854 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK NR1800X is an excellent 5G NR indoor Wi-Fi and SIP CPE from the Chinese company Zeon Electronics (TOTOLINK). Designed to provide fast and easy deployment of NR fixed data services to homes and offices. Totolink NR1800X version 9.1.0u.6279_B20210910 has a buffer overflow vulnerability. The vulnerability originates from the failure of the function loginAuth in the file /cgi-bin/cstecgi.cgi to correctly verify the length of the input data. A remote attacker can exploit this vulnerability on the system. Execute arbitrary code or cause a denial of service attack
Trust: 1.44
IOT TAXONOMY
| category: | ['Network device'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | totolink | model: | nr1800x | scope: | eq | version: | 9.1.0u.6279_b20210910 | Trust: 1.0 |
| vendor: | totolink | model: | nr1800x 9.1.0u.6279 b20210910 | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-121 | Trust: 1.0 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2023-7220 | Trust: 1.6 |
| db: | VULDB | id: | 249854 | Trust: 1.0 |
| db: | CNVD | id: | CNVD-2024-04916 | Trust: 0.6 |
REFERENCES
| url: | https://github.com/jylsec/vuldb/blob/main/totolink/nr1800x/1/readme.md | Trust: 1.0 |
| url: | https://vuldb.com/?ctiid.249854 | Trust: 1.0 |
| url: | https://vuldb.com/?id.249854 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2023-7220 | Trust: 0.6 |
SOURCES
| db: | CNVD | id: | CNVD-2024-04916 |
| db: | NVD | id: | CVE-2023-7220 |
LAST UPDATE DATE
2024-08-14T13:41:20.374000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-04916 | date: | 2024-01-19T00:00:00 |
| db: | NVD | id: | CVE-2023-7220 | date: | 2024-05-17T02:34:19.143 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-04916 | date: | 2024-01-19T00:00:00 |
| db: | NVD | id: | CVE-2023-7220 | date: | 2024-01-09T08:15:36.490 |