Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-34195: TOTOLINK AC1200 Router Firmware: Unrestricted Input Can Crash System

CVE-2024-34195 · published 2 years ago

Summary

An out-of-date version of the TOTOLINK AC1200 Wireless Router's firmware has a security weakness. If an attacker sends specific input to the router's web interface, it could cause the system to crash or allow unauthorized access. Update the router's firmware to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
totolink	a3002r_firmware	1.1.1-b20200824 `cpe:2.3:o:totolink:a3002r_firmware:1.1.1-b20200824:::::::*`

Original advisory text

TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. In the boa server program's CGI handling function formWlEncrypt, there is a lack of length restriction on the wlan_ssid field. This oversight leads to potential buffer overflow under specific circumstances. For instance, by invoking the formWlanRedirect function with specific parameters to alter wlan_idx's value and subsequently invoking the formWlEncrypt function, an attacker can trigger buffer overflow, enabling arbitrary command execution or denial of service attacks.

References

https://gist.github.com/Swind1er/84161b607d06d060fba5adcdd92bceb4 Exploit Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

CWE-121Stack-based Buffer Overflow

Timeline

Published28 Aug 2024

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-34195 · NVD

Track software like this

Free during beta