First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2024-46451

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
totolink	ac1200_t8_firmware	4.1.5cu.861_b20230220

References

https://github.com/offshore0315/loT-vulnerable/blob/main/TOTOLINK/AC1200%20T8/setWiFiAclRules.mdExploit, Third Party Advisory

Timeline

Published: Sep 16, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-464526.1A Host Header injection vulnerability in the password reset function of VigyBag Open Source Online Shop commit 3f0e21b allows attackers to r CVE-2024-464536.1A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scri CVE-2024-464559.8unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.CVE-2024-46466.1A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as problematic. Affected is a CVE-2024-464618.0VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a malicious CVE-2024-464627.8By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them per CVE-2024-464637.8By default, dedicated folders of ORIZON for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perf CVE-2024-464647.8In PRIMX ZED Enterprise up to 2024.3, technical files stored in local folders with common user access can be manipulated to render the host CVE-2024-464657.8By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perf CVE-2024-464667.8By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission) can be accessed by CVE-2024-464677.8By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical files and make them p CVE-2024-464687.5A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive

CVE-2024-46451: Critical severity, CVSS 9.8 | Vulnix