CVE-2024-35396

CriticalCVSS 9.8

Published: 24/05/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

41th percentile - higher than 41% of all known CVEs

Summary

TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228 contains a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, allowing attackers to log in as root.

Risk Assessment

An attacker can gain full unauthorized administrative access to the device, enabling control over the router, network traffic interception, or using it as an entry point into the internal network.

Recommendation

Immediately update the TOTOLINK CP900L firmware to the latest available version that fixes this vulnerability. If no update is available, disable the telnet service and change the default access password.

Original NVD description (English source)

TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to log in as root.