Medium severity · published May 18, 2023
CVE-2023-2790
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
N200re Firmware · Totolink
9.3.5u.6255_b20211224 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2790
Exploit
https://drive.google.com/file/d/1RITXRvKele5aW42YFk0JeQHCq2B63lUj/view?usp=share_link
Permissions Required
https://vuldb.com/?ctiid.229374
Exploit
https://vuldb.com/?id.229374
More from N200re Firmware
9.8
CVE-2024-1001
A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216
9.8
CVE-2024-0299
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216
9.8
CVE-2024-0298
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216
9.8
CVE-2024-0297
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical
9.8
CVE-2024-0296
A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical