CRITICAL Vulnerability Discovered in TOTOLINK's EX1200L Product, Remote Exploitation Possible

CVE-2024-7908

Summary

A vulnerability has been identified in the TOTOLINK EX1200L network device, specifically in the setDefResponse function located in the cstecgi.cgi file. This issue results from improper handling of user-supplied input for the IpAddress argument, which may lead to a stack-based buffer overflow. An attacker can exploit this flaw remotely, allowing unauthorized control over the affected device. The vulnerability poses significant risks as the exploit has been publicly disclosed, and despite notifications, the vendor has not provided any responses concerning the disclosed issues.

References