9

CVE-2024-7212: TOTOLINK A7000R cstecgi.cgi loginauth buffer overflow

Modified
Published 30-07-2024Last modified 01-08-2024

Vulnerability summary

CVE-2024-7212 is a high (CVSS 9.0) Classic Buffer Overflow vulnerability in totolink a7000r_firmware. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 63% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.0/10
010
High · v2.0 (CVE.org)
EPSS score
1.02%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Timeline

  1. 30-07-2024
    PublishedVulnerability first disclosed.
  2. 01-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability, which was classified as critical, has been found in TOTOLINK A7000R 9.1.0u.6268_B20220504. This issue affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272783. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS metrics

7 scores · 2 sources · 4 versions

EPSS trend

Probability

1.02%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.02% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Iot Vulnerable

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Totolink1 product

1 vendor · 1 product

References

4 links