CVE-2024-7159

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. It has been rated as critical. This issue affects some unknown processing of the file /web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier VDB-272573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-259

Affected software

Vendor	Product	Versions
TOTOLINK	A3600R	4.1.2cu.5182_B20201102
totolink	a3600r_firmware	4.1.2cu.5182_b20201102

References

https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/product.mdExploit
https://vuldb.com/?ctiid.272573Permissions Required, Third Party Advisory
https://vuldb.com/?id.272573Permissions Required, Third Party Advisory
https://vuldb.com/?submit.377942Third Party Advisory
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3600R/product.mdExploit
https://vuldb.com/?ctiid.272573Permissions Required, Third Party Advisory
https://vuldb.com/?id.272573Permissions Required, Third Party Advisory
https://vuldb.com/?submit.377942Third Party Advisory

Timeline

Published: Jul 28, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-71608.8A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the fi CVE-2024-71616.5A vulnerability classified as problematic was found in SeaCMS 13.0. Affected by this vulnerability is an unknown functionality of the file /CVE-2024-71625.4A vulnerability, which was classified as problematic, has been found in SeaCMS 12.9/13.0. Affected by this issue is some unknown functionali CVE-2024-71636.1A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer CVE-2024-71649.8A vulnerability has been found in SourceCodester School Fees Payment System 1.0 and classified as critical. This vulnerability affects unkno CVE-2024-71658.8A vulnerability was found in SourceCodester School Fees Payment System 1.0 and classified as critical. This issue affects some unknown proce CVE-2024-71668.8A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-71678.8A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been declared as critical. Affected by this vulnerability CVE-2024-71688.8A vulnerability was found in SourceCodester School Fees Payment System 1.0. It has been rated as critical. Affected by this issue is some un CVE-2024-71698.8A vulnerability classified as problematic has been found in SourceCodester School Fees Payment System 1.0. This affects an unknown part of t CVE-2024-71708.8A vulnerability was found in TOTOLINK A3000RU 5.9c.5185. It has been rated as problematic. This issue affects some unknown processing of the CVE-2024-71718.8A vulnerability classified as critical has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102. Affected is the function NTPSyncWithHost of