Sign-up

ID

VAR-202407-2451


CVE

CVE-2024-7178


TITLE

TOTOLINK  of  a3600r  Classic buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-006417

DESCRIPTION

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been declared as critical. Affected by this vulnerability is the function setMacQos of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument priority/macAddress leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272599. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of a3600r Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A3600R is a 6-antenna 1200M wireless router from China's TOTOLINK Electronics. Remote attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service attack

Trust: 2.16

sources: NVD: CVE-2024-7178 // JVNDB: JVNDB-2024-006417 // CNVD: CNVD-2024-35563

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-35563

AFFECTED PRODUCTS

vendor:totolinkmodel:a3600rscope:eqversion:4.1.2cu.5182_b20201102

Trust: 1.0

vendor:totolinkmodel:a3600rscope: - version: -

Trust: 0.8

vendor:totolinkmodel:a3600rscope:eqversion: -

Trust: 0.8

vendor:totolinkmodel:a3600rscope:eqversion:a3600r firmware 4.1.2cu.5182 b20201102

Trust: 0.8

vendor:totolinkmodel:a3600r 4.1.2cu.5182 b20201102scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2024-35563 // JVNDB: JVNDB-2024-006417 // NVD: CVE-2024-7178

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2024-7178
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2024-7178
value: HIGH

Trust: 1.0

OTHER: JVNDB-2024-006417
value: HIGH

Trust: 0.8

CNVD: CNVD-2024-35563
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2024-7178
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2024-006417
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2024-35563
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2024-7178
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: JVNDB-2024-006417
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-35563 // JVNDB: JVNDB-2024-006417 // NVD: CVE-2024-7178 // NVD: CVE-2024-7178

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-006417 // NVD: CVE-2024-7178

EXTERNAL IDS

db:NVDid:CVE-2024-7178

Trust: 3.2

db:VULDBid:272599

Trust: 1.8

db:JVNDBid:JVNDB-2024-006417

Trust: 0.8

db:CNVDid:CNVD-2024-35563

Trust: 0.6

sources: CNVD: CNVD-2024-35563 // JVNDB: JVNDB-2024-006417 // NVD: CVE-2024-7178

REFERENCES

url:https://github.com/abcdefg-png/iot-vulnerable/blob/main/totolink/a3600r/setmacqos.md

Trust: 1.8

url:https://vuldb.com/?ctiid.272599

Trust: 1.8

url:https://vuldb.com/?id.272599

Trust: 1.8

url:https://vuldb.com/?submit.378045

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-7178

Trust: 1.4

sources: CNVD: CNVD-2024-35563 // JVNDB: JVNDB-2024-006417 // NVD: CVE-2024-7178

SOURCES

db:CNVDid:CNVD-2024-35563
db:JVNDBid:JVNDB-2024-006417
db:NVDid:CVE-2024-7178

LAST UPDATE DATE

2024-08-27T23:10:46.330000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-35563date:2024-08-15T00:00:00
db:JVNDBid:JVNDB-2024-006417date:2024-08-26T01:47:00
db:NVDid:CVE-2024-7178date:2024-08-23T02:55:43.233

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-35563date:2024-08-15T00:00:00
db:JVNDBid:JVNDB-2024-006417date:2024-08-26T00:00:00
db:NVDid:CVE-2024-7178date:2024-07-29T03:15:02.417