PT-2018-11740 · Totolink · Totolink A3002Ru

Published 2018-11-26 · Updated 2018-12-20 · CVE-2018-13317

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8

Description The issue allows attackers to obtain the plaintext password for the admin user by making a GET request for "password.htm". This affects the security of the device as it potentially exposes the admin credentials.

Recommendations For TOTOLINK A3002RU version 1.0.8, consider restricting access to the "password.htm" file until a patch is available. Avoid using the default admin credentials and change them as soon as possible to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-13317

Affected Products

Totolink A3002Ru

References · 3

• 🔥 https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-13317 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13317 · Vendor Advisory