CVE-2024-10654: TOTOLINK LR350 formLoginAuth.htm authorization

Vulnerability summary

CVE-2024-10654 is a critical (CVSS 9.1) Incorrect Privilege Assignment vulnerability in totolink lr350_firmware. EPSS estimates a 1.55% chance of exploitation in the next 30 days, higher than 74.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-11-2024
   PublishedVulnerability first disclosed.
2. 05-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 9.3.5u.6698_B20230810 is able to address this issue. It is recommended to upgrade the affected component.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.