CVE-2024-7157
Published: 28 July 2024
Summary
CVE-2024-7157 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Totolink A3100R Firmware. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A buffer overflow vulnerability exists in the TOTOLINK A3100R router running firmware 4.1.2cu.5050_B20200504. It resides in the getSaveConfig function of /cgi-bin/cstecgi.cgi when processing the http_host argument during configuration save requests and is tracked as CWE-120.
An authenticated remote attacker can supply a crafted http_host value to trigger the overflow, potentially leading to arbitrary code execution or device compromise. The attack requires no user interaction and can be launched over the network.
No vendor patch or mitigation guidance has been released; the vendor was notified prior to public disclosure but did not respond. Public proof-of-concept code is available in open repositories.
The associated CVSS 4.0 score is 8.7 and the EPSS remains flat at 0.0757 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48125
Vulnerability details
A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument http_host leads to buffer overflow. It is possible to initiate the attack…
more
remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.