CVE-2023-2790 Vulnerability Details

  /     /     /  

CVE-2023-2790 Metadata Quick Info

CVE Published: 18/05/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: VulDB | Vendor: TOTOLINK | Product: N200RE
Status : PUBLISHED

---

CVE-2023-2790 Description

A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Affected is an unknown function of the file /squashfs-root/etc_ro/custom.conf of the component Telnet Service. The manipulation leads to password in configuration file. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-229374 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS Version: 3.1 | Base Score: 2.3 LOW
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-260
CWE Name: CWE-260 Password in Configuration File
Source: TOTOLINK

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).