Totolink CP450 Firmware vulnerabilities

19 CVEs affecting Totolink CP450 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-7465, published 2024-08-05.

More from Totolink.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-34219, published 2024-05-14. High severity, CVSS 8.6. EPSS: 20.8% chance of exploitation in the next 30 days. TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.
• CVE-2024-7332, published 2024-08-01. Critical severity, CVSS 9.8. EPSS: 20.7% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK CP450 4.1.0cu.747_B20191224. It has been classified as critical. This affects an unknown part of the file /web_cste/cgi-bin/product.ini of the component Telnet…
• CVE-2024-34218, published 2024-05-14. Low severity, CVSS 3.8. EPSS: 17.6% chance of exploitation in the next 30 days. TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter.
• CVE-2024-34204, published 2024-05-14. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter.
• CVE-2024-7465, published 2024-08-05. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in TOTOLINK CP450 4.1.0cu.747_B20191224. Affected is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the…
• CVE-2024-34206, published 2024-05-14. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter.
• CVE-2024-34210, published 2024-05-14. High severity, CVSS 7.3. EPSS: 1.2% chance of exploitation in the next 30 days. TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the CloudACMunualUpdate function via the FileName parameter.
• CVE-2024-34205, published 2024-05-14. High severity, CVSS 7.3. EPSS: 1.2% chance of exploitation in the next 30 days. TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the download_firmware function.
• CVE-2024-34213, published 2024-05-14. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the SetPortForwardRules function.
• CVE-2024-34209, published 2024-05-14. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setIpPortFilterRules function.

Latest

• CVE-2024-34217, published 2024-05-14. High severity, CVSS 7.7. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the addWlProfileClientMode function.
• CVE-2024-34215, published 2024-05-14. High severity, CVSS 7.3. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function.
• CVE-2024-34212, published 2024-05-14. High severity, CVSS 7.3. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the CloudACMunualUpdate function.
• CVE-2024-34211, published 2024-05-14. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.