CVE-2024-0291

Summary

CVE-2024-0291 is a critical vulnerability affecting the Totolink LR1200GB's firmware version 9.1.0u.6619_B20230130. The issue lies in the UploadFirmwareFile function of the /cgi-bin/cstecgi.cgi file, where manipulation of the argument FileName can result in command injection. This vulnerability allows remote attackers to execute arbitrary commands. The exploit for this vulnerability has been disclosed to the public, and the identifier VDB-249857 has been assigned to it. Unfortunately, the vendor was not responsive when contacted about this disclosure.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.