CVE-2024-31817: TOTOLINK EX200 getSysStatusCfg unauthenticated information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote information disclosure with a public exploit and very high EPSS, though no KEV listing or confirmed in-the-wild use is documented.

What it is

The TOTOLINK EX200 firmware (V4.0.3c.7646_B20201211) exposes sensitive information through the getSysStatusCfg function without requiring authorization. Because the endpoint is reachable over the network with no privileges, any remote party who can reach the device can pull configuration data. This matters for range extenders that are often left on default settings and reachable from the LAN or WAN side.

Impact

An attacker gains sensitive device configuration information without authentication, which can expose credentials, network settings or other data useful for follow-on attacks. There is no integrity or availability impact per the CVSS vector; the loss is confidentiality only.

Attack surface

Reached over the network via the getSysStatusCfg function, per the CVSS vector AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. Any host that can reach the device's management interface can trigger it.

Exploitation

A public exploit write-up exists (reference tagged Exploit), and EPSS is 0.5534 (99th percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Apply the vendor firmware update for TOTOLINK EX200 if one is available; the record does not name a fixed version, so confirm with TOTOLINK.
• If no patch exists, restrict access to the device management interface to trusted networks only and block it from the WAN.
• Change default administrative credentials and disable remote management where the device supports it.
• Segment IoT and range extender devices on a separate VLAN with no access to sensitive internal systems.
• Monitor vendor advisories for a fixed firmware release and track the device as end-of-support risk if none appears.

Detection

• Monitor network traffic to the EX200 management interface for requests to the getSysStatusCfg endpoint from unexpected hosts.
• Alert on access to the device web interface from outside the trusted management VLAN or from WAN-facing addresses.
• Baseline normal management traffic to the device and flag new or repeated unauthenticated requests to configuration functions.
• Review device logs, if available, for configuration retrieval events from unknown source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.