PT-2018-11740 · Totolink · Totolink A3002Ru

Publicado 2018-11-26 · Atualizado 2018-12-20 · CVE-2018-13317

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8

Description The issue allows attackers to obtain the plaintext password for the admin user by making a GET request for "password.htm". This affects the security of the device as it potentially exposes the admin credentials.

Recommendations For TOTOLINK A3002RU version 1.0.8, consider restricting access to the "password.htm" file until a patch is available. Avoid using the default admin credentials and change them as soon as possible to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-13317

Produtos afetados

Totolink A3002Ru

Referências · 3

• 🔥 https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-13317 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13317 · Aviso do Fabricante