Cp300+ Firmware vulnerabilities

3 known vulnerabilities in Cp300+ Firmware from TOTOLINK. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  cp300\+: Use of Hard-coded Credentials

  CVE-2024-36782Jun 3, 2024TOTOLINK

  TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.

• 7.5 High severity

  cp300\+: Observable Discrepancy

  CVE-2023-34669Jul 17, 2023TOTOLINK

  TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.

• 9.8 Critical severity

  Cp300+ Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2023-31856May 16, 2023TOTOLINKEPSS 2.91%

  A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.