Description:

CVE-2024-36782 is a hardcoded password vulnerability in TOTOLINK CP300 V2.0.4-B20201102, allowing attackers to log in as root via the /etc/shadow.sample file. Despite a CVSS score of 0, SOCRadar's SVRS assigns a score of 34, indicating a moderate risk.

Key Insights:

• Exploitable by Unauthenticated Attackers: The vulnerability can be exploited without requiring authentication, making it accessible to a wide range of attackers.
• Root Access Granted: Successful exploitation grants attackers root access to the affected device, enabling them to execute arbitrary commands and compromise the entire system.
• Limited Impact: The vulnerability's impact is limited to devices running TOTOLINK CP300 V2.0.4-B20201102 firmware.

Mitigation Strategies:

• Update Firmware: Install the latest firmware update from TOTOLINK to patch the vulnerability.
• Disable Remote Access: Restrict remote access to the affected devices until the firmware is updated.
• Change Default Password: If possible, change the default password for the root account to prevent unauthorized access.
• Monitor Network Traffic: Implement network monitoring tools to detect suspicious activity and identify potential exploitation attempts.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have not been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• In the Wild: The vulnerability is not known to be actively exploited by hackers.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.