PT-2018-11730 · Totolink · Totolink A3002Ru

Publicado 2018-11-27 · Atualizado 2019-10-03 · CVE-2018-13307

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8

Description The issue allows attackers to execute system commands via the ntpServerIp2 POST parameter in the fromNtp function. Certain payloads can cause the device to become permanently inoperable.

Recommendations For TOTOLINK A3002RU version 1.0.8, avoid using the ntpServerIp2 parameter in the affected POST request until the issue is resolved. As a temporary workaround, consider restricting access to the fromNtp function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-13307

Produtos afetados

Totolink A3002Ru

Referências · 3

• 🔥 https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 · Exploit
• https://osv.dev/vulnerability/CVE-2018-13307 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13307 · Nota de Segurança