Remote Code Execution Vulnerability in TOTOLINK A3600R

CVE-2024-7171

Summary

A significant security vulnerability has been identified in the TOTOLINK A3600R device, specifically in the function NTPSyncWithHost located in the cgi script /cgi-bin/cstecgi.cgi. This flaw allows for OS command injection through the manipulation of the 'hostTime' argument. The vulnerability can be exploited remotely, enabling attackers to execute arbitrary commands on the device. The exploit details have been disclosed publicly, raising serious security concerns for users of this device. It is imperative for affected users to secure their systems and monitor for unusual activities, as the vendor has not yet addressed this critical issue.

References