CVSS: 2.6EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7216 – TOTOLINK LR1200 shadow.sample hard-coded password
https://notcve.org/view.php?id=CVE-2024-7216
A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md https://vuldb.com/?ctiid.272787 https://vuldb.com/?id.272787 https://vuldb.com/?submit.378331 • CWE-259: Use of Hard-coded Password •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7215 – TOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injection
https://notcve.org/view.php?id=CVE-2024-7215
A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/NTPSyncWithHost.md https://vuldb.com/?ctiid.272786 https://vuldb.com/?id.272786 https://vuldb.com/?submit.378330 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •