Hard-coded Password Vulnerability in TOTOLINK CP450 Telnet Service

CVE-2024-7332

Summary

A critical vulnerability has been identified in the TOTOLINK CP450 device, specifically within its Telnet service configuration file, 'product.ini'. The flaw arises from the use of a hard-coded password, which can be leveraged by an attacker to gain unauthorized remote access to the system. This vulnerability poses significant security risks, especially for Internet of Things (IoT) devices, given their often limited security measures. Exploitation of this flaw could lead to unauthorized actions being executed on affected devices. The issue has been publicly disclosed, raising immediate concerns for users of the affected version, particularly without timely vendor responses to mitigate the impact.

References