Remote Buffer Overflow Vulnerability in TOTOLINK A3600R Router

CVE-2024-7183

Summary

A vulnerability has been identified in the TOTOLINK A3600R router, specifically within the setUploadSetting function found in the /cgi-bin/cstecgi.cgi file. This flaw allows an attacker to manipulate the FileName argument, resulting in a buffer overflow condition. The vulnerability can be exploited remotely, meaning that attackers do not need physical access to the device to initiate an attack. The exploit, which was disclosed publicly, poses a significant security risk, particularly for users of the affected version 4.1.2cu.5182_B20201102. The vendor was alerted about this issue but failed to respond, leading to concerns regarding user safety and potential exploitation. It is advised for users to monitor their devices and apply any available updates or mitigations to safeguard against potential attacks.

References