Critical severity · published Dec 25, 2023
CVE-2023-7095
Totolink A7100RU HTTP POST Request main buffer overflow
9.8
CVSS
13.7%
EPSS
No
On KEV
Description
A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.7% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A7
A7100RU · Totolink
7.4cu.2313_B20191024 · source: vendor
AF
A7100ru Firmware · Totolink
7.4cu.2313_b20191024 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-7095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-7095
Exploit
https://github.com/unpWn4bL3/iot-security/blob/main/2.md
Permissions Required
https://vuldb.com/?ctiid.248942
Third Party Advisory
https://vuldb.com/?id.248942
More from A7100RU
9.8
CVE-2023-6906
Totolink A7100RU HTTP POST Request main buffer overflow