CVE-2024-0292

MEDIUM EXPLOITED

Totolink LR1200GB 9.1.0u.6619_B20230130 - OS Command Injection via hostName Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-0292 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249858 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.249858
Permissions Required, Third Party Advisory, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.249858

Scores

CVSS v3 6.3
EPSS 0.0151
EPSS Percentile 81.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2025-07-13
CWE
CWE-78
Status published
Products (1)
totolink/lr1200gb_firmware 9.1.0u.6619_b20230130
Published Jan 08, 2024
Tracked Since Feb 18, 2026