CVE-2024-7463CWE-120

TOTOLINK CP900 cstecgi.cgi UploadCustomModule buffer overflow

High · published August 5, 2024

CVSS v4.0

8.7

EPSS

11%

Percentile

95.9

In the wild

Unconfirmed

What it is

A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273556. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v4.0: 8.7 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.10978 · 95.9th percentile
Weakness: CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published: 2024-08-05T00:31Z

EPSS history

Timeline

05 AUG 00:31Z
TOTOLINK CP900 cstecgi.cgi UploadCustomModule buffer overflow
cvelistv5