Buffer Overflow Weakness in TOTOLINK A3600R Devices

CVE-2024-7177

Summary

A critical buffer overflow vulnerability has been identified in the TOTOLINK A3600R router, specifically in the setLanguageCfg function located in the /cgi-bin/cstecgi.cgi file. This flaw arises from improper handling of the langType argument, allowing an attacker to exploit the vulnerability remotely. If successfully executed, this exploit could lead to unauthorized access and control over the affected device. Public disclosure of the vulnerability has occurred, underlining the urgent need for users to apply necessary patches and mitigations. Notably, the vendor has not responded to early disclosure attempts, emphasizing the importance of proactive security measures.

References