Cyber Resilience

CVE-2024-7154

Access Control in Totolink A3700R Firmware 9.1.2u.5822_b20200513

Public PoCAccess Control
Published
28 July 2024
Modified
21 November 2024
CVSS Score v4 5.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0043 35th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2024-7154 is a medium-severity Improper Access Control (CWE-284) vulnerability in Totolink A3700R Firmware. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.html of the component Password Reset Handler. The manipulation leads to improper access controls. It is possible to launch…

more

the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272568. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-3664Same product: Totolink A3700R
CVE-2025-3666Same product: Totolink A3700R
CVE-2025-3665Same product: Totolink A3700R
CVE-2025-3675Same product: Totolink A3700R
CVE-2025-3667Same product: Totolink A3700R
CVE-2025-3668Same product: Totolink A3700R
CVE-2025-3674Same product: Totolink A3700R
CVE-2025-3663Same product: Totolink A3700R
CVE-2023-43141Same product: Totolink A3700R
CVE-2024-31805Same vendor: Totolink

Affected Assets

totolink
a3700r firmware
9.1.2u.5822_b20200513

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 4 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.3.5
  • V6.2.3
  • V6.4.4
  • V10.4.16

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-284 CWE-306

Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.

addresses: CWE-284 CWE-306

Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.

addresses: CWE-284 CWE-306

Requiring authorization and configuration controls for mobile device connections directly enforces access control and prevents unauthorized devices from reaching organizational systems.

addresses: CWE-284 CWE-306

Provides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies.

addresses: CWE-284 CWE-306

Provides capability to review session content, directly detecting violations of access control.

addresses: CWE-284 CWE-306

Control assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.

addresses: CWE-284 CWE-306

Certification requires independent assessment confirming access controls are implemented correctly and effective.

addresses: CWE-284 CWE-306

Restricting available functions and services reduces the attack surface and enforces proper access control boundaries.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 full match
prevents

Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces policy-based access management and least privilege, eliminating most improper-access-control defects, yet CWE-284 also covers implementation flaws and design gaps outside a single management control.

PR.PS-01 mostly match
prevents

Hardened baselines and deviation monitoring directly eliminate most configuration-induced access-control defects, yet CWE-284 also encompasses code-level and design flaws outside the scope of configuration management alone.

PR.PS-06 mostly match
prevents

Secure SDLC practices catch most access-control defects during design/coding/testing (mostly), yet leave residual risk from runtime configuration, architecture, and operational controls (partial).

PR.AA-01 partial match
prevents

PR.AA-01 supplies managed identities/credentials that support but do not implement access-control decisions, so it only partially prevents CWE-284 in either direction.

PR.DS-01 partial match
prevents

PR.DS-01 encryption mitigates impact of failed access checks on stored data but neither implements nor constrains access-control logic itself.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Defining and enforcing explicit access rights and restrictions for each entity directly stops the assignment of permissions that exceed what is required, eliminating the root condition that allows improper access control.

prevents

Formal authorization, role-based provisioning, and timely revocation of access rights directly stop the creation of accounts or permissions that exceed what the business actually needs.

prevents

By enforcing explicit rules on which identities or groups may perform read, write, delete or execute operations and by denying anonymous access to sensitive data, the control directly stops the creation of overly permissive or missing access-control checks.

prevents

The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.

prevents

Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.

prevents

By explicitly transferring security roles and responsibilities when personnel change jobs or leave, the control reduces the chance that former employees retain access rights they no longer need, thereby limiting improper access control.

References