PT-2018-11730 · Totolink · Totolink A3002Ru

Published 2018-11-27 · Updated 2019-10-03 · CVE-2018-13307

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8

Description The issue allows attackers to execute system commands via the ntpServerIp2 POST parameter in the fromNtp function. Certain payloads can cause the device to become permanently inoperable.

Recommendations For TOTOLINK A3002RU version 1.0.8, avoid using the ntpServerIp2 parameter in the affected POST request until the issue is resolved. As a temporary workaround, consider restricting access to the fromNtp function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-13307

Affected Products

Totolink A3002Ru

References · 3

• 🔥 https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 · Exploit
• https://osv.dev/vulnerability/CVE-2018-13307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13307 · Security Note