CVE-2024-31810

The manufacturer embedded a static, unchanging password for the root account in the firmware image, stored in the /etc/shadow.sample file. Since the password is identical across all devices with a given software version, an attacker who learns it (e.g., through firmware analysis) can log in to the root account on any vulnerable device. The vulnerability is classified as CWE-798 (use of hardcoded credentials) and CWE-259 (hardcoded password).

An attacker gains full administrator (root) privileges on the device, enabling complete takeover of the router/extender, modification of its configuration, interception of network traffic, and potential use of the device as an entry point to the local network.

Apply patches available from the manufacturer according to the references. Until an update is obtained, it is recommended to restrict access to the device management interface exclusively from trusted network segments and isolate the device from critical network resources.

TOTOLINK EX200 with firmware version V4.0.3c.7646_B20201211