PT-2023-25751 · Totolink · Totolink A7000R+1
CVE-2023-36950
·
Publicado
2023-10-16
·
Atualizado
2024-09-12
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TOTOLINK X5000R version 9.1.0u.6118 B20201102
TOTOLINK A7000R version 9.1.0u.6115 B20201022
Description
A stack overflow issue was discovered via the
http host parameter in the loginAuth function. This issue affects the login authentication process.Recommendations
For TOTOLINK X5000R version 9.1.0u.6118 B20201102, consider disabling the
loginAuth function until a patch is available.
For TOTOLINK A7000R version 9.1.0u.6115 B20201022, restrict access to the http host parameter in the affected API endpoint until the issue is resolved.
Avoid using the http host parameter in the login authentication process until a fix is provided.Exploit
Correção
Stack Overflow
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Totolink A7000R
Totolink X5000R