CVE-2023-6906 | Totolink A7100RU 7.4cu.2313_B20191024 HTTP POST Request cstecgi.cgi main flag buffer overflow

A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag with the input ie8 leads to buffer overflow.

This vulnerability is traded as CVE-2023-6906. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.