CVE-2022-29377 Memory corruption in n/a

What is CVE-2022-29377?

CVE-2022-29377 is a high-severity memory corruption vulnerability in n/a, published on 24 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Totolink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a stacker overflow in the fread function at infostat.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via the parameter CONTENT_LENGTH.

Weakness: CWE-787

Which versions are affected by CVE-2022-29377?

It affects 1 product.

Products include Totolink A3600r Firmware.

How do I fix CVE-2022-29377?

No fix has been published for CVE-2022-29377 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-29377 being exploited?

There is no known exploitation of CVE-2022-29377 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-31027 Memory corruption in n/a Critical 9.8
• CVE-2022-34993 Hardcoded credentials in n/a Critical 9.8
• CVE-2022-25078 Command injection in n/a Critical 9.8
• CVE-2026-1686 Totolink A3600R app.so setAppEasyWizardConfig buffer overflow High 8.7
• CVE-2024-7174 TOTOLINK A3600R cstecgi.cgi setdeviceName buffer overflow High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xxp7-f9hw-8j74.