CVE-2024-31812

NVD	https://nvd.nist.gov/vuln/detail/CVE-2024-31812
CWE	https://cwe.mitre.org/data/definitions/75.html

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-31812

CWE

https://cwe.mitre.org/data/definitions/75.html

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.

Weakness

The product does not adequately filter user-controlled input for special elements with control implications.

Potential Mitigations

https://cwe.mitre.org/data/definitions/81.html
https://cwe.mitre.org/data/definitions/93.html

References

https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_getWiFiExtenderConfig/Leak.md
https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_getWiFiExtenderConfig/Leak.md

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Weakness

Potential Mitigations

Related Attack Patterns

References