CVE-2024-0292: Totolink LR1200GB cstecgi.cgi setOpModeCfg os command injection
First published: Mon Jan 08 2024(Updated: )
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Totolink Lr1200 Firmware | =9.1.0u.6619_b20230130 | |
| Totolink Lr1200gb Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-0292?
CVE-2024-0292 is classified as a critical vulnerability due to the potential for remote code execution through OS command injection.
How does CVE-2024-0292 affect the Totolink LR1200GB?
CVE-2024-0292 affects the Totolink LR1200GB by allowing attackers to manipulate the hostName argument in the setOpModeCfg function, leading to OS command injection.
How do I fix CVE-2024-0292?
To fix CVE-2024-0292, update the Totolink LR1200GB firmware to a patched version that addresses this vulnerability.
What components are vulnerable in CVE-2024-0292?
The vulnerable component in CVE-2024-0292 is the setOpModeCfg function located in /cgi-bin/cstecgi.cgi.
Can CVE-2024-0292 be exploited remotely?
Yes, CVE-2024-0292 can be exploited remotely, allowing attackers to execute arbitrary commands on the vulnerable device.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/severity
- agent/references
- agent/title
- agent/author
- agent/event
- agent/softwarecombine
- agent/description
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/totolink
- canonical/totolink lr1200 firmware
- version/totolink lr1200 firmware/9.1.0u.6619_b20230130
- canonical/totolink lr1200gb firmware