Yuxin_Wang

**Name of the Vulnerable Software and Affected Versions** BusyBox versions prior to 1.30.1 **Description** A null pointer dereference occurs in the `FEATURE WGET TIMEOUT` handler within the `networking/wget.c` file. This issue is triggered by the manipulation of the `-T` argument and requires local access to be exploited. **Recommendations** Apply patch 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff to versions prior to 1.30.1.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK EX1200L version 9.3.5u.6146 B20201023 **Description** A remote attack can be initiated against the Password Configuration Handler component. The issue exists in the `setPasswordCfg()` function within the '/cgi-bin/cstecgi.cgi' endpoint, where manipulation leads to a null pointer dereference. A null pointer dereference occurs when a program attempts to read or write to a memory address that is null, typically causing the application to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/cgi-bin/cstecgi.cgi' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** TOTOLINK EX1200L version 9.3.5u.6146 B20201023 **Description** A remote attack can be launched against the `/cgi-bin/cstecgi.cgi` endpoint by manipulating the `setWizardCfg()` function, leading to a null pointer dereference. A null pointer dereference occurs when a program attempts to read from or write to a memory address that is null, typically causing the application to crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/cgi-bin/cstecgi.cgi` endpoint to minimize the risk of exploitation.