CVE-2024-34257

CRITICAL EXPLOITED NUCLEI

TOTOLINK EX1800T <V9.1.0cu.2112 - Command Injection

Title source: llm

Exploitation Summary

CVE-2024-34257 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges.

Nuclei Templates (1)

TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection

HIGHby pussycat0x

Shodan: http.title:"totolink"

FOFA: title="totolink"

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/EX1800T/1.md

View Exploit ZIP pw:eip

Broken Link

https://immense-mirror-b42.notion.site/TOTOLINK-EX1800T-has-an-unauthorized-arbitrary-command-execution-vulnerability-2f3e308f5e1d45a2b8a64f198cacc350

Scores

CVSS v3 9.8

EPSS 0.0385

EPSS Percentile 88.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

VulnCheck KEV 2024-08-13

CWE

CWE-285

Status published

Products (1)

totolink/ex1800t_firmware 9.1.0cu.2112_b20220316

Published May 08, 2024

Tracked Since Feb 18, 2026