A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime/eTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Totolink
  • Ac1200 T10 Firmware
  • Ac1200 T8 Firmware
  • T10
  • T10 Firmware
  • T8
  • T8 Firmware

Configuration 1 [-]

AND
cpe:2.3:o:totolink:t8_firmware:4.1.5cu.861_b20230220:*:*:*:*:*:*:*
cpe:2.3:h:totolink:t8:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:totolink:t10_firmware:4.1.8cu.5207:*:*:*:*:*:*:*
cpe:2.3:h:totolink:t10:-:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/AC1200T8/setParentalRules.md cve-icon cve-icon
https://vuldb.com/?ctiid.276807 cve-icon cve-icon
https://vuldb.com/?id.276807 cve-icon cve-icon
https://vuldb.com/?submit.401262 cve-icon cve-icon
https://www.totolink.net/ cve-icon cve-icon
History

Mon, 03 Mar 2025 18:15:00 +0000

Type Values Removed Values Added
Description A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime/eTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
Weaknesses CWE-119

Tue, 10 Sep 2024 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Totolink ac1200 T10 Firmware
Totolink ac1200 T8 Firmware
CPEs cpe:2.3:o:totolink:ac1200_t10_firmware:4.1.5cu.861_b20230220:*:*:*:*:*:*:*
cpe:2.3:o:totolink:ac1200_t8_firmware:4.1.5cu.861_b20230220:*:*:*:*:*:*:*
Vendors & Products Totolink ac1200 T10 Firmware
Totolink ac1200 T8 Firmware
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Sep 2024 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Totolink t10
Totolink t10 Firmware
CPEs cpe:2.3:o:totolink:t8_firmware:4.1.8cu.5207:*:*:*:*:*:*:* cpe:2.3:h:totolink:t10:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:t10_firmware:4.1.8cu.5207:*:*:*:*:*:*:*
Vendors & Products Totolink t10
Totolink t10 Firmware

Mon, 09 Sep 2024 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Totolink
Totolink t8
Totolink t8 Firmware
CPEs cpe:2.3:h:totolink:t8:-:*:*:*:*:*:*:*
cpe:2.3:o:totolink:t8_firmware:4.1.5cu.861_b20230220:*:*:*:*:*:*:*
cpe:2.3:o:totolink:t8_firmware:4.1.8cu.5207:*:*:*:*:*:*:*
Vendors & Products Totolink
Totolink t8
Totolink t8 Firmware

Sun, 08 Sep 2024 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setParentalRules buffer overflow
Weaknesses CWE-120
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2025-03-03T18:05:09.848Z

Reserved: 2024-09-07T17:15:07.117Z

Link: CVE-2024-8573

cve-icon Vulnrichment

Updated: 2024-09-10T14:41:13.702Z

cve-icon NVD

Status : Modified

Published: 2024-09-08T10:15:01.907

Modified: 2025-03-03T18:15:30.130

Link: CVE-2024-8573

cve-icon Redhat

No data.