CVE-2024-7157

Summary

CVE-2024-7157 is a critical vulnerability identified in the TOTOLINK A3100R 4.1.2cu.5050_B20200504 firmware. The issue lies in the getSaveConfig function of the /cgi-bin/cstecgi.cgi?action=save&setting file, which is susceptible to a buffer overflow when the argument http_host is manipulated. This vulnerability can be exploited remotely, allowing attackers to potentially execute arbitrary code. The exploit for this vulnerability (VDB-272571) has been disclosed to the public. Despite early contact, the vendor has not responded to disclose a patch or remediation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.