CVE-2024-51228

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-51228
An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities
https://totolink.tw/support_view/A3002RU
https://totolink.tw/support_view/N150RT
https://www.totolink.tw/products_view/N300RT
https://www.totolink.tw/products_view/N302RE
Configurations

No configuration.

History

29 Nov 2024, 20:15

Type Values Removed Values Added
Summary
  • (es) Un problema en TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 y TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 y TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 y TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 y TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 y TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 permite que un atacante remoto ejecute código arbitrario a través del componente /boafrm/formSysCmd.
CWE CWE-78
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.8

27 Nov 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-27 17:15

Updated : 2024-11-29 20:15

NVD link : CVE-2024-51228

Mitre link : CVE-2024-51228

CVE.ORG link : CVE-2024-51228

JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')