CVE-2024-35396 identifies a critical vulnerability in TOTOLINK CP900L firmware version 4.1.5cu.798_B20221228, where a hardcoded password for telnet access is embedded in the /web_cste/cgi-bin/product.ini file. This flaw enables unauthenticated attackers to gain root-level access to the device via telnet, posing a severe security risk. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 9.8, reflecting its critical impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability allows an attacker to log in as root via telnet using the hardcoded password, resulting in full control over the affected device. This compromises the confidentiality, integrity, and availability of the device and potentially the network it is connected to.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable telnet access if possible or restrict network access to the device to trusted hosts only. Monitor vendor channels for updates and apply patches promptly once available.