Buffer Overflow Vulnerability in TOTOLINK A3600R

CVE-2024-7172

What is CVE-2024-7172?

A critical vulnerability has been identified in the TOTOLINK A3600R router that affects the functionality of the 'getSaveConfig' command located at /cgi-bin/cstecgi.cgi?action=save&setting. The exploit occurs through manipulation of the 'http_host' argument, which leads to a buffer overflow condition. This vulnerability can be exploited remotely, allowing attackers to execute arbitrary code and potentially gain unauthorized access to network configurations. This issue has been disclosed publicly; however, there has been no response from the vendor despite early notification. It is crucial for users of the impacted version to take immediate action to mitigate risks associated with this vulnerability.

References