Totolink: Security Vulnerabilities
In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.
CVSS Score
6.5
EPSS Score
0.055
Published
2022-03-30
totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.
CVSS Score
9.8
EPSS Score
0.026
Published
2022-03-30
In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function turned on.
CVSS Score
8.8
EPSS Score
0.009
Published
2022-03-30
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.
CVSS Score
9.8
EPSS Score
0.125
Published
2022-03-30
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.
CVSS Score
8.8
EPSS Score
0.012
Published
2022-03-30
Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing host data in the HTTP request process.
CVSS Score
9.8
EPSS Score
0.011
Published
2022-03-25
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.
CVSS Score
9.8
EPSS Score
0.039
Published
2022-03-22
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
CVSS Score
9.8
EPSS Score
0.196
Published
2022-03-22
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.
CVSS Score
9.8
EPSS Score
0.034
Published
2022-03-22
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.
CVSS Score
9.8
EPSS Score
0.034
Published
2022-03-22