Totolink CP900L Firmware vulnerabilities

8 CVEs affecting Totolink CP900L Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-35403, published 2024-05-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-35397, published 2024-05-28. High severity, CVSS 8.8. EPSS: 15.1% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to…
CVE-2024-35401, published 2024-05-28. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
CVE-2024-35398, published 2024-05-28. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setMacFilterRules.
CVE-2024-35396, published 2024-05-24. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to log in as root.
CVE-2024-35400, published 2024-05-28. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules
CVE-2024-35403, published 2024-05-28. Low severity, CVSS 2.7. EPSS: 0.4% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules
CVE-2024-35395, published 2024-05-24. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.
CVE-2024-35399, published 2024-05-28. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the password parameter in the function loginAuth