CVE-2024-9001mediumexploração observadaCWE-78

CVE-2024-9001: falha de média gravidade em TOTOLINK T10

TOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injection

Publicada em

Seguir esta CVE+ Monitorar T10

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

35Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck.

ssvc Attendcvss 5.3epss 3.3%
da publicação à arma
Publicada no NVD19 de set.
VulnCheck+297d
A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
TOTOLINK · T10
CVEs relacionadas — TOTOLINK T10

No mesmo produto, das mais perigosas para as menos.

CVE-2025-5905HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflowEPSS 12.4%CVE-2025-9533MEDIUMTOTOLINK T10 formLoginAuth.htm improper authenticationEPSS 12.2%CVE-2025-5904HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflowEPSS 12.1%CVE-2025-5903HIGHTOTOLINK T10 POST Request cstecgi.cgi setWiFiAclRules buffer overflowEPSS 12.1%CVE-2025-5901HIGHTOTOLINK T10 POST Request cstecgi.cgi UploadCustomModule buffer overflowEPSS 6.9%CVE-2025-5902HIGHTOTOLINK T10 POST Request cstecgi.cgi setUpgradeFW buffer overflowEPSS 6.5%