| शीर्षक | Totolink N350RT V9.3.5u.6265 Broken Access Control |
|---|
| विवरण | V9.3.5u.6265 of the device allows remote attackers to obtain Wi-Fi system information and modify system-related settings without logging in via port 80, path /cgi-bin/cstecgi.cgi, parameter topicurl.
This version does not verify that the administrator is logged in, so the attacker does not need to bring in the cookie obtained after the administrator has logged in, and can directly obtain the Wi-Fi SSID and Wi-Fi password.
Sending a request to modify the system settings without bringing in any cookies can modify the system settings, in a normal and secure situation it must be verified that the cookies are brought in after the administrator has logged in.
Totolink says the vulnerability has been fully patched and the latest patched version is available for download at https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/206/ids/36.html
Note: This vulnerability is the same as CVE-2023-7223, but in a different device and version. |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1xmGHvjMTaOn7v6buju5Ifuti3q47G7yF/view?usp=sharing |
|---|
| उपयोगकर्ता | lin7lic (UID 39301) |
|---|
| सबमिशन | 08/01/2024 02:34 AM (3 साल पहले) |
|---|
| संयम | 16/01/2024 08:06 AM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 250786 [Totolink N350RT 9.3.5u.6265 Setting /cgi-bin/cstecgi.cgi अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|