CVE-2024-36782 - Vulnerability Details - OpenCVE

TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Totolink	Cp300 Cp300 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:totolink:cp300_firmware:2.0.4-b20201102:*:*:*:*:*:*:*

cpe:2.3:h:totolink:cp300:2.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20cp300/README.md

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00275}`	epss `{'score': 0.00359}`

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00232}`	epss `{'score': 0.00275}`

Fri, 30 May 2025 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Totolink Totolink cp300 Totolink cp300 Firmware
CPEs		cpe:2.3:h:totolink:cp300:2.0:::::::* cpe:2.3:o:totolink:cp300_firmware:2.0.4-b20201102:::::::*
Vendors & Products		Totolink Totolink cp300 Totolink cp300 Firmware

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-06-03T20:09:40.333Z

Updated: 2025-02-13T15:59:38.336Z

Reserved: 2024-05-30T00:00:00.000Z

Link: CVE-2024-36782

Vulnrichment

Updated: 2024-08-02T03:43:49.143Z

NVD

Status : Analyzed

Published: 2024-06-03T21:15:08.453

Modified: 2025-05-30T16:50:13.077

Link: CVE-2024-36782

Redhat

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-36782", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-02-13T15:59:38.336Z", "datePublished": "2024-06-03T20:09:40.333Z", "dateReserved": "2024-05-30T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-03T20:09:40.776Z"}, "descriptions": [{"lang": "en", "value": "TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20cp300/README.md"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36782", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-04T14:52:52.577207Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:totolink:cp300\\+:-:*:*:*:*:*:*:*"], "vendor": "totolink", "product": "cp300\\+", "versions": [{"status": "affected", "version": "v2.0.4_b20201102"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:47:39.222Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:49.143Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20cp300/README.md", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20cp300/README.md", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:43:49.143Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-36782", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-04T14:52:52.577207Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:totolink:cp300\\+:-:*:*:*:*:*:*:*"], "vendor": "totolink", "product": "cp300\\+", "versions": [{"status": "affected", "version": "v2.0.4_b20201102"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T14:59:22.139Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/s4ndw1ch136/IOT-vuln-reports/blob/main/totolink%20cp300/README.md"}], "descriptions": [{"lang": "en", "value": "TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-03T20:09:40.776434"}}}, "cveMetadata": {"cveId": "CVE-2024-36782", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:43:49.143Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre"}, "dataVersion": "5.1"}