CVE-2024-7217
Published: 30 July 2024
Summary
CVE-2024-7217 is a medium-severity Classic Buffer Overflow (CWE-120) vulnerability in Totolink Ca300-Poe Firmware. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2024-7217 is a buffer overflow vulnerability in the loginauth function within the file /cgi-bin/cstecgi.cgi on TOTOLINK CA300-PoE firmware version 6.2c.884. The issue stems from improper handling of the password argument and is tracked as CWE-120. It was publicly disclosed on 2024-07-30 with a CVSS 4.0 score of 5.3.
An authenticated remote attacker can supply a crafted password value to trigger the overflow. Successful exploitation may allow limited manipulation of confidentiality, integrity, and availability on the affected device, and a proof-of-concept has already been published.
The vendor was notified prior to disclosure but provided no response or patch. Public references consist of exploit details hosted on GitHub and entries in the VulDB database; no official mitigation guidance is available. The associated EPSS score has remained flat at 0.0848 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48184
Vulnerability details
A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely.…
more
The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the remotely accessible web CGI authentication endpoint (/cgi-bin/cstecgi.cgi loginauth password parameter) enables unauthenticated remote code execution, directly facilitating exploitation of a public-facing application.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.