CVE-2024-7158

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnet_enabled leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272572. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
TOTOLINK	A3100R	4.1.2cu.5050_B20200504
totolink	a3100r	4.1.2cu.5050

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3100R/setTelnetCfg.mdExploit
https://vuldb.com/?ctiid.272572Permissions Required, Third Party Advisory
https://vuldb.com/?id.272572Third Party Advisory
https://vuldb.com/?submit.377543Third Party Advisory
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3100R/setTelnetCfg.mdExploit
https://vuldb.com/?ctiid.272572Permissions Required, Third Party Advisory
https://vuldb.com/?id.272572Third Party Advisory
https://vuldb.com/?submit.377543Third Party Advisory

Timeline

Published: Jul 28, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-71598.8A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processi CVE-2024-71608.8A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the fi CVE-2024-71616.5A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /CVE-2024-71625.4A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionali CVE-2024-71636.1A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer CVE-2024-71649.8A vulnerability has been found in SourceCodester School Fees Payment System 1.0 and classified as critical. This vulnerability affects unkno CVE-2024-71658.8A vulnerability was found in SourceCodester School Fees Payment System 1.0 and classified as critical. This issue affects some unknown proce CVE-2024-71668.8A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-71678.8A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been declared as critical. Affected by this vulnerability CVE-2024-71688.8A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been rated as critical. Affected by this issue is some un CVE-2024-71698.8A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of t CVE-2024-71708.8A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the