Buffer Overflow Vulnerability in TOTOLINK LR350 Router
CVE-2022-44258

8.8HIGH

Key Information:

Vendor

Totolink
Status
Lr350 Firmware
Vendor
CVE Published:
23 November 2022

What is CVE-2022-44258?

The TOTOLINK LR350 router, specifically version 9.3.5u.6369_B20220309, suffers from a buffer overflow vulnerability due to improper handling of the 'command' parameter in the 'setTracerouteCfg' function. This flaw occurs post-authentication, allowing an authenticated user to exploit this weakness, leading to potential unauthorized access or denial of service, which could compromise the router's functionality and security.

References

https://brief-nymphea-813.notion.site/LR350-bof-setTracer...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.