Hardcoded Password Vulnerability in TOTOLINK Router Firmware
CVE-2023-24155

9.8CRITICAL

Key Information:

Vendor
Totolink
Status
T8 Firmware
Vendor
CVE Published:
3 February 2023

Summary

The TOTOLINK T8 router firmware version V4.1.5cu was found to contain a hardcoded password within the telnet service configuration, which is stored in the file /web_cste/cgi-bin/product.ini. This significant security flaw allows unauthorized access to the device, enabling potential attackers to exploit the router’s functionalities and gain control over the system, thereby compromising network integrity and user privacy.

References

https://github.com/Double-q1015/CVE-vulns/blob/main/totol...

EPSS Score

1% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.