CVE Feed

    Dashboard / CVE / CVE-2024-1661

    CVE-2024-1661

    A vulnerability classified as problematic was found in Totolink X6000R 9.4.0cu.852_B20230719. Affected by this vulnerability is an unknown functionality of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254179. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

    Published:Feb 20, 2024
    Last Modified:Nov 21, 2024
    EPS:Feb 20, 2024
    EPSS Score:0.00048
    CVSS Score:2.5

    Affected Products

    Vendor
    Totolink
    Product
    X6000r Firmware

    Exploits

    https://github.com/WoodManGitHub/MyCVEs/blob/main/2024-Totolink/X6000R-Hardcoded-Password.mdhttps://github.com/WoodManGitHub/MyCVEs/blob/main/2024-Totolink/X6000R-Hardcoded-Password.md

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2026-4611 (CVSS 8.6) — A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue…
    CVE-2025-70328 (CVSS 8.8) — TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost …
    CVE-2025-11005 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52907 (CVSS 7.3) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Command Injection, File Manipulation.This is…
    CVE-2025-52906 (CVSS 9.3) — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TO…
    CVE-2025-52905 (CVSS 7) — Improper Input Validation vulnerability in TOTOLINK X6000R allows Flooding.This issue affects X6000R: through …
    CVE-2025-52053 (CVSS 9.8) — TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D…
    CVE-2025-52284 (CVSS 6.5) — Totolink X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_4184…
    CVE-2025-25524 (CVSS 5.1) — Buffer overflow vulnerability in TOTOLink X6000R routers V9.4.0cu.652_B20230116 due to the lack of length veri…
    CVE-2024-52723 (CVSS 9.8) — In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High