Sign-up

ID

VAR-202401-2354


CVE

CVE-2024-22660


TITLE

TOTOLINK A3700R setLanguageCfg method buffer overflow vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-15328

DESCRIPTION

TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg. TOTOLINK A3700R is a wireless router produced by China's TOTOLINK Electronics. The vulnerability is caused by the setLanguageCfg method failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 1.44

sources: NVD: CVE-2024-22660 // CNVD: CNVD-2025-15328

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-15328

AFFECTED PRODUCTS

vendor:totolinkmodel:a3700rscope:eqversion:9.1.2u.6165_20211012

Trust: 1.0

vendor:totolinkmodel:a3700r v9.1.2u.6165 20211012scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-15328 // NVD: CVE-2024-22660

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-22660
value: CRITICAL

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2024-22660
value: CRITICAL

Trust: 1.0

CNVD: CNVD-2025-15328
value: HIGH

Trust: 0.6

CNVD: CNVD-2025-15328
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-22660
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 2.0

sources: CNVD: CNVD-2025-15328 // NVD: CVE-2024-22660 // NVD: CVE-2024-22660

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

sources: NVD: CVE-2024-22660

EXTERNAL IDS

db:NVDid:CVE-2024-22660

Trust: 1.6

db:CNVDid:CNVD-2025-15328

Trust: 0.6

sources: CNVD: CNVD-2025-15328 // NVD: CVE-2024-22660

REFERENCES

url:https://github.com/covteam/iot_vuln/tree/main/setlanguagecfg

Trust: 1.6

sources: CNVD: CNVD-2025-15328 // NVD: CVE-2024-22660

SOURCES

db:CNVDid:CNVD-2025-15328
db:NVDid:CVE-2024-22660

LAST UPDATE DATE

2025-07-10T23:00:07.487000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-15328date:2025-07-09T00:00:00
db:NVDid:CVE-2024-22660date:2025-06-20T20:15:29.823

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-15328date:2025-07-09T00:00:00
db:NVDid:CVE-2024-22660date:2024-01-23T15:15:11.867