5.5

CVE-2023-2790

Exploit

A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Data is provided by the National Vulnerability Database (NVD)
Totolink ≫ N200re Firmware Version9.3.5u.6255_b20211224
   Totolink ≫ N200re Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.053
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cna@vuldb.com 2.3 0.8 1.4
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
cna@vuldb.com 1.4 2.5 2.9
AV:L/AC:L/Au:M/C:P/I:N/A:N
CWE-260 Password in Configuration File

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

https://vuldb.com/?ctiid.229374
Third Party Advisory
Permissions Required
https://vuldb.com/?id.229374
Third Party Advisory
Exploit