CVE-2024-0569

Katalog CVE

CVSS 9.1 · Critical EPSS 0,95%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada totolink t8 firmware. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.833_20220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.5cu.862_B20230228 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-250785 was assigned to this vulnerability.

Rincian

Terbit di NVD

16 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-862: Missing Authorization

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://drive.google.com/file/d/1WSWrGEKUkvPk8hq1VRng-wbR7T6CknGY/view?usp=sharing exploit · advisory pihak ketiga
• https://vuldb.com/?ctiid.250785 permissions required · advisory pihak ketiga · vdb entry
• https://vuldb.com/?id.250785 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.263653 advisory pihak ketiga · vdb entry
• https://www.chtsecurity.com/news/8aa31e69-1e7c-4186-8554-7d5d6baeaa84 advisory pihak ketiga
• https://www.chtsecurity.com/news/8f270890-12cc-4623-99a3-a81e00758c29 advisory pihak ketiga