VYPR
← All advisories
High severity8.8NVD Advisory· Published May 28, 2024· Updated Jul 9, 2026

CVE-2024-35397

CVE-2024-35397

Description

TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

Affected products

3
  • Totolink/Cp900l Firmware
    cpe:2.3:o:totolink:cp900l_firmware:4.1.5cu.798_b20221228:*:*:*:*:*:*:*
  • Totolink/CP900Lcpe-rescue2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: 4.1.5cu.798_B20221228

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.