Details of VAR-202408-2290

ID

VAR-202408-2290

CVE

CVE-2024-8075

TITLE

TOTOLINK of T8 in the firmware OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2024-007099

DESCRIPTION

A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg. The manipulation leads to os command injection. The attack can be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of T8 The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK AC1200 T8 is a dual-band full Gigabit router from China's TOTOLINK Electronics. TOTOLINK AC1200 T8 has an operating system command injection vulnerability, which is caused by the setDiagnosisCfg method failing to properly filter special characters and commands in the construction command. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2024-8075 // JVNDB: JVNDB-2024-007099 // CNVD: CNVD-2025-08337

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-08337

AFFECTED PRODUCTS

vendor:	totolink	model:	t8	scope:	eq	version:	4.1.5cu.862_b20230228	Trust: 1.0
vendor:	totolink	model:	t8	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	t8	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	t8	scope:	eq	version:	t8 firmware 4.1.5cu.862 b20230228	Trust: 0.8
vendor:	totolink	model:	ac1200 t8 4.1.5cu.862 b20230228	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-08337 // JVNDB: JVNDB-2024-007099 // NVD: CVE-2024-8075

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2024-8075
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2024-8075
value:	CRITICAL
Trust: 1.0
OTHER:	JVNDB-2024-007099
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2025-08337
value:	MEDIUM
Trust: 0.6

cna@vuldb.com:	CVE-2024-8075
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2024-007099
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-08337
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	8.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2024-8075
baseSeverity:	MEDIUM
baseScore:	6.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	LOW
exploitabilityScore:	2.8
impactScore:	3.4
version:	3.1
Trust: 1.0
nvd@nist.gov:	CVE-2024-8075
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2024-007099
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-08337 // JVNDB: JVNDB-2024-007099 // NVD: CVE-2024-8075 // NVD: CVE-2024-8075

PROBLEMTYPE DATA

problemtype:	CWE-78	Trust: 1.0
problemtype:	OS Command injection (CWE-78) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2024-007099 // NVD: CVE-2024-8075

PATCH

title:

Patch for TOTOLINK AC1200 T8 OS Command Injection Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/682281

Trust: 0.6

sources: CNVD: CNVD-2025-08337

EXTERNAL IDS

db:	NVD	id:	CVE-2024-8075	Trust: 3.2
db:	VULDB	id:	275557	Trust: 1.8
db:	JVNDB	id:	JVNDB-2024-007099	Trust: 0.8
db:	CNVD	id:	CNVD-2025-08337	Trust: 0.6

sources: CNVD: CNVD-2025-08337 // JVNDB: JVNDB-2024-007099 // NVD: CVE-2024-8075

REFERENCES

url:	https://github.com/hawkteam404/rnd_public/blob/main/totolink_ac1200_t8_oscmdi_bof.md	Trust: 1.8
url:	https://vuldb.com/?id.275557	Trust: 1.8
url:	https://vuldb.com/?submit.390929	Trust: 1.8
url:	https://www.totolink.net/	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2024-8075	Trust: 1.4
url:	https://vuldb.com/?ctiid.275557	Trust: 1.0

sources: CNVD: CNVD-2025-08337 // JVNDB: JVNDB-2024-007099 // NVD: CVE-2024-8075

SOURCES

db:	CNVD	id:	CNVD-2025-08337
db:	JVNDB	id:	JVNDB-2024-007099
db:	NVD	id:	CVE-2024-8075

LAST UPDATE DATE

2025-04-26T22:28:32.524000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-08337	date:	2025-04-25T00:00:00
db:	JVNDB	id:	JVNDB-2024-007099	date:	2024-09-03T03:21:00
db:	NVD	id:	CVE-2024-8075	date:	2024-12-13T14:46:14.797

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-08337	date:	2025-04-22T00:00:00
db:	JVNDB	id:	JVNDB-2024-007099	date:	2024-09-03T00:00:00
db:	NVD	id:	CVE-2024-8075	date:	2024-08-22T20:15:10.210