How severe is CVE-2024-31812?

CVE-2024-31812 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2024-31812 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-31812?

CVE-2024-31812 affects Totolink Ex200 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-31812?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-31812 have an EU (EUVD) identifier?

Yes. CVE-2024-31812 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-29685.

When was CVE-2024-31812 published?

CVE-2024-31812 was published on 2024-04-08 and last updated on 2026-06-17.

CVE-2024-31812

CVE-2024-31812 is a medium-severity vulnerability in Totolink Ex200 Firmware with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-75.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (26th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-29685
Weakness: CWE-75
Affected product: Totolink Ex200 Firmware
Published: 2024-04-08
Last modified: 2026-06-17

Description

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.

Frequently asked questions

What is CVE-2024-31812?: In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.
How severe is CVE-2024-31812?: CVE-2024-31812 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2024-31812 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (26th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-31812?: CVE-2024-31812 affects Totolink Ex200 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-31812?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-31812 have an EU (EUVD) identifier?: Yes. CVE-2024-31812 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-29685.
When was CVE-2024-31812 published?: CVE-2024-31812 was published on 2024-04-08 and last updated on 2026-06-17.

References

https://github.com/4hsien/CVE-vulns/blob/main/TOTOLINK/EX200/Leak_getWiFiExtenderConfig/Leak.md

Affected products (1)

cpe:2.3:o:totolink:ex200_firmware:4.0.3c.7646_b20201211:*:*:*:*:*:*:*

More vulnerabilities in Totolink Ex200 Firmware

CVE-2024-31810 — Critical (CVSS 9.8): TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2024-31807 — Critical (CVSS 9.8): TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the…
CVE-2021-43711 — Critical (CVSS 9.8): The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when…
CVE-2024-31815 — Critical (CVSS 9.1): In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through…
CVE-2024-7336 — High (CVSS 8.8): A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected by this…
CVE-2024-7335 — High (CVSS 8.8): A vulnerability classified as critical has been found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected is the function…

All CVEs affecting Totolink Ex200 Firmware →

Other CWE-75 vulnerabilities

CVE-2026-29042 — Critical (CVSS 9.8): Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.15.20, the Nuclio Shell…
CVE-2025-50213 — Critical (CVSS 9.8): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow…
CVE-2024-35373 — Critical (CVSS 9.8): Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php.
CVE-2021-22910 — Critical (CVSS 9.8): A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an…
CVE-2021-22911 — Critical (CVSS 9.8): A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to…
CVE-2026-31908 — Critical (CVSS 9.1): Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in…

Browse all CWE-75 vulnerabilities →