Sign-up

ID

VAR-202407-2398


CVE

CVE-2024-7184


TITLE

TOTOLINK  of  a3600r  Classic buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2024-006408

DESCRIPTION

A vulnerability has been found in TOTOLINK A3600R 4.1.2cu.5182_B20201102 and classified as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument url leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of a3600r Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A3600R is a 6-antenna 1200M wireless router from China's TOTOLINK Electronics. TOTOLINK A3600R has a buffer overflow vulnerability. The vulnerability is caused by the url parameter in the setUrlFilterRules function of the /cgi-bin/cstecgi.cgi file failing to properly verify the length of the input data. Attackers can exploit this vulnerability to execute arbitrary code on the system or cause a denial of service

Trust: 2.16

sources: NVD: CVE-2024-7184 // JVNDB: JVNDB-2024-006408 // CNVD: CNVD-2025-13255

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-13255

AFFECTED PRODUCTS

vendor:totolinkmodel:a3600rscope:eqversion:4.1.2cu.5182_b20201102

Trust: 1.0

vendor:totolinkmodel:a3600rscope: - version: -

Trust: 0.8

vendor:totolinkmodel:a3600rscope:eqversion: -

Trust: 0.8

vendor:totolinkmodel:a3600rscope:eqversion:a3600r firmware 4.1.2cu.5182 b20201102

Trust: 0.8

vendor:totolinkmodel:a3600r 4.1.2cu.5182 b20201102scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-13255 // JVNDB: JVNDB-2024-006408 // NVD: CVE-2024-7184

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2024-7184
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2024-7184
value: HIGH

Trust: 1.0

OTHER: JVNDB-2024-006408
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-13255
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2024-7184
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2024-006408
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-13255
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2024-7184
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: JVNDB-2024-006408
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-13255 // JVNDB: JVNDB-2024-006408 // NVD: CVE-2024-7184 // NVD: CVE-2024-7184

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-006408 // NVD: CVE-2024-7184

EXTERNAL IDS

db:NVDid:CVE-2024-7184

Trust: 3.2

db:VULDBid:272605

Trust: 2.4

db:JVNDBid:JVNDB-2024-006408

Trust: 0.8

db:CNVDid:CNVD-2025-13255

Trust: 0.6

sources: CNVD: CNVD-2025-13255 // JVNDB: JVNDB-2024-006408 // NVD: CVE-2024-7184

REFERENCES

url:https://vuldb.com/?id.272605

Trust: 2.4

url:https://github.com/abcdefg-png/iot-vulnerable/blob/main/totolink/a3600r/seturlfilterrules.md

Trust: 1.8

url:https://vuldb.com/?ctiid.272605

Trust: 1.8

url:https://vuldb.com/?submit.378053

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-7184

Trust: 0.8

sources: CNVD: CNVD-2025-13255 // JVNDB: JVNDB-2024-006408 // NVD: CVE-2024-7184

SOURCES

db:CNVDid:CNVD-2025-13255
db:JVNDBid:JVNDB-2024-006408
db:NVDid:CVE-2024-7184

LAST UPDATE DATE

2025-06-21T23:39:21.288000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-13255date:2025-06-20T00:00:00
db:JVNDBid:JVNDB-2024-006408date:2024-08-26T01:20:00
db:NVDid:CVE-2024-7184date:2024-08-23T14:32:00.667

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-13255date:2025-06-20T00:00:00
db:JVNDBid:JVNDB-2024-006408date:2024-08-26T00:00:00
db:NVDid:CVE-2024-7184date:2024-07-29T05:15:02.203