CVE-2024-0998

HIGH

Totolink N200RE 9.3.5u.6139_B20201216 - Buffer Overflow

Title source: llm

Description

A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252267. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

References (3)

Core 3

Core References

Third Party Advisory vdb-entry technical-description

https://vuldb.com/?id.252267

Third Party Advisory signature permissions-required

https://vuldb.com/?ctiid.252267

Exploit, Third Party Advisory exploit

https://jylsec.notion.site/TOTOLINK-N200RE-has-stack-buffer-overflow-vulnerability-in-setDiagnosisCfg-b2d36451543e4c6da063646721a24604?pvs=4

Scores

CVSS v3 7.2

EPSS 0.0047

EPSS Percentile 64.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-121

Status published

Products (1)

totolink/n200re_firmware 9.3.5u.6139_b20201216

Published Jan 29, 2024

Tracked Since Feb 18, 2026