Vulnerability-Lookup

CNVD-2025-14533

Vulnerability from cnvd - Published: 2025-07-01

Title

TOTOLINK LR1200硬编码密码漏洞

Description

TOTOLINK LR1200是一款专为4G LTE网络设计的无线路由器‌。 TOTOLINK LR1200存在硬编码密码漏洞，该漏洞源于/etc/shadow.sample页面包含一个使用硬编码密码。目前没有详细的漏洞细节提供。

Severity

低

Formal description

目前厂商尚未发布升级程序修复该安全问题，详情见厂商官网： https://www.totolink.net/

Reference

https://vuldb.com/?id.272787

Impacted products

Name
TOTOLINK LR1200 9.3.1cu.2832

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-7216",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-7216"
    }
  },
  "description": "TOTOLINK LR1200\u662f\u4e00\u6b3e\u4e13\u4e3a4G LTE\u7f51\u7edc\u8bbe\u8ba1\u7684\u65e0\u7ebf\u8def\u7531\u5668\u200c\u3002\n\nTOTOLINK LR1200\u5b58\u5728\u786c\u7f16\u7801\u5bc6\u7801\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e/etc/shadow.sample\u9875\u9762\u5305\u542b\u4e00\u4e2a\u4f7f\u7528\u786c\u7f16\u7801\u5bc6\u7801\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u7684\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5c1a\u672a\u53d1\u5e03\u5347\u7ea7\u7a0b\u5e8f\u4fee\u590d\u8be5\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u89c1\u5382\u5546\u5b98\u7f51\uff1a\r\nhttps://www.totolink.net/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-14533",
  "openTime": "2025-07-01",
  "products": {
    "product": "TOTOLINK LR1200 9.3.1cu.2832"
  },
  "referenceLink": "https://vuldb.com/?id.272787",
  "serverity": "\u4f4e",
  "submitTime": "2024-08-02",
  "title": "TOTOLINK LR1200\u786c\u7f16\u7801\u5bc6\u7801\u6f0f\u6d1e"
}

CVE-2024-7216 (GCVE-0-2024-7216)

Vulnerability from cvelistv5 – Published: 2024-07-30 04:00 – Updated: 2024-08-01 21:52

Title

TOTOLINK LR1200 shadow.sample hard-coded password

Summary

A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity ?

2.1 (Low)


                        
                          CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

2.6 (Low)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

2.6 (Low)


                        
                          CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-259 - Use of Hard-coded Password

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.272787	vdb-entry
	https://vuldb.com/?ctiid.272787	signaturepermissions-required
	https://vuldb.com/?submit.378331	third-party-advisory
	https://github.com/abcdefg-png/IoT-vulnerable/blo…	exploit

Impacted products

	Vendor	Product	Version
	TOTOLINK	LR1200	Affected: 9.3.1cu.2832

Credits

yhryhryhr_miemie (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:totolink:lr1200_firmware:9.3.1cu.2832:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "lr1200_firmware",
            "vendor": "totolink",
            "versions": [
              {
                "status": "affected",
                "version": "9.3.1cu.2832"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7216",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-30T14:20:40.359345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-30T14:48:20.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T21:52:31.490Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VDB-272787 | TOTOLINK LR1200 shadow.sample hard-coded password",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.272787"
          },
          {
            "name": "VDB-272787 | CTI Indicators (IOB, IOC, TTP, IOA)",
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.272787"
          },
          {
            "name": "Submit #378331 | TOTOLINK LR1200 V9.3.1cu.2832 Use of Hard-coded Password",
            "tags": [
              "third-party-advisory",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?submit.378331"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "LR1200",
          "vendor": "TOTOLINK",
          "versions": [
            {
              "status": "affected",
              "version": "9.3.1cu.2832"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "yhryhryhr_miemie (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in TOTOLINK LR1200 9.3.1cu.2832 ausgemacht. Sie wurde als problematisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei /etc/shadow.sample. Durch das Beeinflussen mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.4,
            "vectorString": "AV:A/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259 Use of Hard-coded Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-30T04:00:05.592Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-272787 | TOTOLINK LR1200 shadow.sample hard-coded password",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/?id.272787"
        },
        {
          "name": "VDB-272787 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.272787"
        },
        {
          "name": "Submit #378331 | TOTOLINK LR1200 V9.3.1cu.2832 Use of Hard-coded Password",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.378331"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/TOTOLINK/LR1200/shadow.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-29T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2024-07-29T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2024-07-29T20:23:00.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "TOTOLINK LR1200 shadow.sample hard-coded password"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-7216",
    "datePublished": "2024-07-30T04:00:05.592Z",
    "dateReserved": "2024-07-29T18:17:45.931Z",
    "dateUpdated": "2024-08-01T21:52:31.490Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-14533

CVE-2024-7216 (GCVE-0-2024-7216)

Tags

Sightings

Nomenclature