CVE-2024-34198

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34198
TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. The formWlEncrypt CGI handler in the boa program fails to limit the length of the wlan_ssid field from user input. This allows attackers to craft malicious HTTP requests by supplying an excessively long value for the wlan_ssid field, leading to a stack overflow. This can be further exploited to execute arbitrary commands or launch denial-of-service attacks.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Swind1er/02f6cb414e440c34878f20fef756e286
Configurations

No configuration.

History

29 Aug 2024, 20:36

Type Values Removed Values Added
CWE CWE-120
Summary
  • (es) El enrutador inalámbrico TOTOLINK AC1200 A3002RU V2.1.1-B20230720.1011 es vulnerable a desbordamiento de búfer. El controlador CGI formWlEncrypt en el programa boa no limita la longitud del campo wlan_ssid de la entrada del usuario. Esto permite a los atacantes crear solicitudes HTTP maliciosas al proporcionar un valor excesivamente largo para el campo wlan_ssid, lo que provoca un desbordamiento de pila. Esto se puede explotar aún más para ejecutar comandos arbitrarios o lanzar ataques de denegación de servicio.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

28 Aug 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-28 15:15

Updated : 2024-08-29 20:36

NVD link : CVE-2024-34198

Mitre link : CVE-2024-34198

CVE.ORG link : CVE-2024-34198

JSON object : View

Products Affected

No product.

CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')