CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7177 – TOTOLINK A3600R cstecgi.cgi setLanguageCfg buffer overflow
https://notcve.org/view.php?id=CVE-2024-7177
29 Jul 2024 — A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been classified as critical. Affected is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument langType leads to buffer overflow. It is possible to launch the attack remotely. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setLanguageCfg.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7176 – TOTOLINK A3600R cstecgi.cgi setIpQosRules buffer overflow
https://notcve.org/view.php?id=CVE-2024-7176
29 Jul 2024 — A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. This issue affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument comment leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setIpQosRules.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7175 – TOTOLINK A3600R cstecgi.cgi setDiagnosisCfg os command injection
https://notcve.org/view.php?id=CVE-2024-7175
29 Jul 2024 — A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ipDoamin leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setDiagnosisCfg.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7174 – TOTOLINK A3600R cstecgi.cgi setdeviceName buffer overflow
https://notcve.org/view.php?id=CVE-2024-7174
29 Jul 2024 — A vulnerability, which was classified as critical, was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. This affects the function setdeviceName of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument deviceMac/deviceName leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/setDeviceName.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7173 – TOTOLINK A3600R cstecgi.cgi loginauth buffer overflow
https://notcve.org/view.php?id=CVE-2024-7173
28 Jul 2024 — A vulnerability, which was classified as critical, has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected by this issue is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password/http_host leads to buffer overflow. The attack may be launched remotely. VDB-272594 is the identifier assigned to this vulnerability. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/loginauth.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2024-7172 – TOTOLINK A3600R getSaveConfig buffer overflow
https://notcve.org/view.php?id=CVE-2024-7172
28 Jul 2024 — A vulnerability classified as critical was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected by this vulnerability is the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument http_host leads to buffer overflow. The attack can be launched remotely. • https://vuldb.com/?id.272593 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7171 – TOTOLINK A3600R cstecgi.cgi NTPSyncWithHost os command injection
https://notcve.org/view.php?id=CVE-2024-7171
28 Jul 2024 — A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostTime leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://vuldb.com/?id.272592 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7159 – TOTOLINK A3600R Telnet Service product.ini hard-coded password
https://notcve.org/view.php?id=CVE-2024-7159
28 Jul 2024 — A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processing of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/product.md • CWE-259: Use of Hard-coded Password •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-36455
https://notcve.org/view.php?id=CVE-2022-36455
25 Aug 2022 — TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi. Se ha detectado que TOTOLink A3600R versión V4.1.2cu.5182_B20201102, contiene una vulnerabilidad de inyección de comandos por medio del parámetro username en el archivo /cstecgi.cgi. • https://github.com/Darry-lang1/vuln/blob/main/TOTOLINK/A3600R/1/readme.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 1CVE-2022-34993
https://notcve.org/view.php?id=CVE-2022-34993
04 Aug 2022 — Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample. Totolink A3600R_Firmware versión V4.1.2cu.5182_B20201102, contiene una contraseña embebida para root en el archivo /etc/shadow.sample • http://www.totolink.cn/home/menu/detail.html?menu_listtpl=download&id=63&ids=36image-20220606105532193 • CWE-798: Use of Hard-coded Credentials •