CVE-2024-8869

Name of the Vulnerable Software and Affected Versions: TOTOLINK A720R version 4.1.5

Description: A critical vulnerability has been found, affecting the exportOvpn function, which leads to os command injection. The attack can be launched remotely, with a rather high complexity and difficult exploitability. The vendor was contacted about this disclosure but did not respond. There have been reports of offensive activities targeting this vulnerability.

Recommendations: For TOTOLINK A720R version 4.1.5, as a temporary workaround, consider disabling the exportOvpn function until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.