Sign-up

ID

VAR-202409-0405


CVE

CVE-2024-8869


TITLE

TOTOLINK  of  A720R  in the firmware  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2024-008756

DESCRIPTION

A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. TOTOLINK of A720R The firmware has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK A720R is a wireless router. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2024-8869 // JVNDB: JVNDB-2024-008756 // CNVD: CNVD-2025-12711

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-12711

AFFECTED PRODUCTS

vendor:totolinkmodel:a720rscope:eqversion:4.1.5

Trust: 1.6

vendor:totolinkmodel:a720rscope: - version: -

Trust: 0.8

vendor:totolinkmodel:a720rscope:eqversion: -

Trust: 0.8

vendor:totolinkmodel:a720rscope:eqversion:a720r firmware 4.1.5

Trust: 0.8

sources: CNVD: CNVD-2025-12711 // JVNDB: JVNDB-2024-008756 // NVD: CVE-2024-8869

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2024-8869
value: LOW

Trust: 1.0

nvd@nist.gov: CVE-2024-8869
value: HIGH

Trust: 1.0

OTHER: JVNDB-2024-008756
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-12711
value: MEDIUM

Trust: 0.6

cna@vuldb.com: CVE-2024-8869
severity: MEDIUM
baseScore: 4.6
vectorString: AV:N/AC:H/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2024-008756
severity: MEDIUM
baseScore: 4.6
vectorString: AV:N/AC:H/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-12711
severity: MEDIUM
baseScore: 4.6
vectorString: AV:N/AC:H/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2024-8869
baseSeverity: MEDIUM
baseScore: 5.0
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 1.6
impactScore: 3.4
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2024-8869
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2024-008756
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-12711 // JVNDB: JVNDB-2024-008756 // NVD: CVE-2024-8869 // NVD: CVE-2024-8869

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-008756 // NVD: CVE-2024-8869

EXTERNAL IDS

db:NVDid:CVE-2024-8869

Trust: 3.2

db:VULDBid:277506

Trust: 2.4

db:JVNDBid:JVNDB-2024-008756

Trust: 0.8

db:CNVDid:CNVD-2025-12711

Trust: 0.6

sources: CNVD: CNVD-2025-12711 // JVNDB: JVNDB-2024-008756 // NVD: CVE-2024-8869

REFERENCES

url:https://vuldb.com/?id.277506

Trust: 2.4

url:https://vuldb.com/?submit.403211

Trust: 2.4

url:https://www.totolink.net/

Trust: 2.4

url:https://vuldb.com/?ctiid.277506

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2024-8869

Trust: 0.8

sources: CNVD: CNVD-2025-12711 // JVNDB: JVNDB-2024-008756 // NVD: CVE-2024-8869

SOURCES

db:CNVDid:CNVD-2025-12711
db:JVNDBid:JVNDB-2024-008756
db:NVDid:CVE-2024-8869

LAST UPDATE DATE

2025-06-19T23:30:42.241000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-12711date:2025-06-17T00:00:00
db:JVNDBid:JVNDB-2024-008756date:2024-09-24T05:06:00
db:NVDid:CVE-2024-8869date:2024-09-20T16:59:22.560

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-12711date:2025-06-17T00:00:00
db:JVNDBid:JVNDB-2024-008756date:2024-09-24T00:00:00
db:NVDid:CVE-2024-8869date:2024-09-15T11:15:13.323