Details of VAR-202407-2331

ID

VAR-202407-2331

CVE

CVE-2024-7217

TITLE

TOTOLINK of CA300-PoE Classic buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-005015

DESCRIPTION

A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. This vulnerability affects the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of CA300-PoE Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK CA300-PoE is a wireless access point of China's Jiweng Electronics (TOTOLINK) company. The vulnerability is caused by the password parameter in the loginauth function of the /cgi-bin/cstecgi.cgi page failing to correctly verify the length of the input data. Attackers can exploit this vulnerability to cause a denial of service

Trust: 2.16

sources: NVD: CVE-2024-7217 // JVNDB: JVNDB-2024-005015 // CNVD: CNVD-2025-12894

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-12894

AFFECTED PRODUCTS

vendor:	totolink	model:	ca300-poe	scope:	eq	version:	6.2c.884	Trust: 1.0
vendor:	totolink	model:	ca300-poe	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	ca300-poe	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	ca300-poe	scope:	eq	version:	ca300-poe firmware 6.2c.884	Trust: 0.8
vendor:	totolink	model:	ca300-poe 6.2c.884	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-12894 // JVNDB: JVNDB-2024-005015 // NVD: CVE-2024-7217

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2024-7217
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2024-7217
value:	HIGH
Trust: 1.0
OTHER:	JVNDB-2024-005015
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2025-12894
value:	MEDIUM
Trust: 0.6

cna@vuldb.com:	CVE-2024-7217
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2024-005015
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-12894
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2024-7217
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2024-7217
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2024-005015
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-12894 // JVNDB: JVNDB-2024-005015 // NVD: CVE-2024-7217 // NVD: CVE-2024-7217

PROBLEMTYPE DATA

problemtype:	CWE-120	Trust: 1.0
problemtype:	Classic buffer overflow (CWE-120) [ others ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-005015 // NVD: CVE-2024-7217

EXTERNAL IDS

db:	NVD	id:	CVE-2024-7217	Trust: 3.2
db:	VULDB	id:	272788	Trust: 1.6
db:	JVNDB	id:	JVNDB-2024-005015	Trust: 0.8
db:	CNVD	id:	CNVD-2025-12894	Trust: 0.6

sources: CNVD: CNVD-2025-12894 // JVNDB: JVNDB-2024-005015 // NVD: CVE-2024-7217

REFERENCES

url:	https://github.com/abcdefg-png/iot-vulnerable/blob/main/totolink/ca300-poe/loginauth_password.md	Trust: 1.8
url:	https://vuldb.com/?submit.378333	Trust: 1.8
url:	https://vuldb.com/?id.272788	Trust: 1.6
url:	https://vuldb.com/?ctiid.272788	Trust: 1.0
url:	https://nvd.nist.gov/vuln/detail/cve-2024-7217	Trust: 0.8

sources: CNVD: CNVD-2025-12894 // JVNDB: JVNDB-2024-005015 // NVD: CVE-2024-7217

SOURCES

db:	CNVD	id:	CNVD-2025-12894
db:	JVNDB	id:	JVNDB-2024-005015
db:	NVD	id:	CVE-2024-7217

LAST UPDATE DATE

2025-06-21T23:18:29.347000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-12894	date:	2025-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2024-005015	date:	2024-08-08T03:13:00
db:	NVD	id:	CVE-2024-7217	date:	2024-08-06T13:54:06.807

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-12894	date:	2025-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2024-005015	date:	2024-08-08T00:00:00
db:	NVD	id:	CVE-2024-7217	date:	2024-07-30T05:15:09.957