We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-0997

Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflow



Description

EN DE

A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252266 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Reserved 2024-01-29 | Published 2024-01-29 | Updated 2024-09-05 | Assigner VulDB


HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
HIGH: 7.2CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
8.3AV:N/AC:L/Au:M/C:C/I:C/A:C

Problem types

CWE-121 Stack-based Buffer Overflow

Product status

9.3.5u.6139_B20201216
affected

Timeline

2024-01-29:Advisory disclosed
2024-01-29:VulDB entry created
2024-01-29:VulDB entry last update

Credits

jylsec (VulDB User) reporter

References

vuldb.com/?id.252266 vdb-entry technical-description

vuldb.com/?ctiid.252266 signature permissions-required

jylsec.notion.site/...9faac02b13d84bd3b7fe84aab68c7add?pvs=4 exploit

cve.org (CVE-2024-0997)

nvd.nist.gov (CVE-2024-0997)

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-0997

Support options

Helpdesk Chat, Email, Knowledgebase
Subscribe to our newsletter to learn more about our work.

MonTueWedThuFriSatSun
303112345678910111213141516171819202122232425262728293031123456789
MonTueWedThuFriSatSun
303112345678910111213141516171819202122232425262728293031123456789