Medium severity · published Jul 28, 2024
CVE-2024-7155
TOTOLINK A3300R shadow.sample hard-coded password
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-272569 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A3
A3300R · TOTOLINK
17.0.0cu.557_B20221024 · source: vendor, CISA
AF
A3300r Firmware · Totolink
17.0.0cu.557_b20221024 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7155
Exploit
https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/A3300R/shadow.md
Permissions Required
https://vuldb.com/?ctiid.272569
Third Party Advisory
https://vuldb.com/?id.272569
Third Party Advisory
https://vuldb.com/?submit.377465
More from A3300R
9.8
CVE-2025-12240
TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflow
9.8
CVE-2025-12239
TOTOLINK A3300R cstecgi.cgi setDdnsCfg buffer overflow
9.8
CVE-2024-24329
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function
8.8
CVE-2025-12241
TOTOLINK A3300R POST Parameter cstecgi.cgi setLanguageCfg stack-based overflow
8.8
CVE-2024-7331
TOTOLINK A3300R cstecgi.cgi UploadCustomModule buffer overflow