PT-2024-9038 · Totolink · Totolink X18

Monologue

·

CVE-2024-10966

·

Published

2024-07-11

·

Updated

2024-12-16

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329
Description: A critical issue has been found in the TOTOLINK X18, affecting some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the enable argument leads to os command injection. This issue may be exploited remotely. The exploit has been disclosed to the public.
Recommendations: For version 9.1.0cu.2024 B20220329, update to the latest firmware immediately to mitigate risks. As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file until a patch is available. Avoid using the enable argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78CWE-77

Related Identifiers

BDU:2024-10720
CVE-2024-10966

Affected Products

Totolink X18