CVE-2024-34257

CRITICALNuclei

TOTOLINK EX1800T apcliEncrypType Vulnerability

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-34257 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 13, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 1, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

EX1800T

Browse TOTOLINK / EX1800T
VulnCheckVersion data not supplied

ex1800t_firmware

Browse totolink / ex1800t_firmware

Default status: unknown

CVE List9.1.0cu.2112_b20220316affected

Nuclei templates

1
ProjectDiscoveryHIGHTOTOLINK EX1800T TOTOLINK EX1800T - Command Injection

TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges.

Impact

Unauthenticated attackers can execute arbitrary commands via the apcliEncrypType parameter, gaining device administrator privileges.

Remediation

Update TOTOLINK EX1800T firmware to a version that patches the command injection vulnerability.

Authorspussycat0x
Template tagscvecve2024rceunauthvkevvuln
Shodan: http.title:"totolink"
FOFA: title="totolink"
Google: intitle:"totolink"
https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/EX1800T/1.md https://immense-mirror-b42.notion.site/TOTOLINK-EX1800T-has-an-unauthorized-arbitrary-command-execution-vulnerability-2f3e308f5e1d45a2b8a64f198cacc350 https://github.com/20142995/nuclei-templates

Source: ProjectDiscovery

References

3