Description
TOTOLINK EX200是一款2.4G 无线范围扩展器。 TOTOLINK EX200 NTPSyncWithHost接口存在未经身份验证的命令执行漏洞，攻击者可获取系统权限。
TOTOLINK EX200 /cgi-bin/cstecgi.cgi NTPSyncWithHost 命令执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-31807
https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/CI_2_NTPSyncWithHost/CI.md
https://avd.aliyun.com/detail?id=AVD-2024-0296
https://dbugs.ptsecurity.com/vulnerability/PT-2024-2866
https://stack.watch/product/totolink/ex200-firmware/
https://vuldb.com/vuln/273258
https://www.vulncheck.com/advisories/totolink-routers-authenticated-command-injection-via-cstecgi-cgi