PT-2020-8530 · Totolink · Totolink A3002Ru

Published 2020-02-24 · Updated 2020-03-04 · CVE-2018-13313

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002RU version 1.0.8

Description: The issue concerns a page, password.htm, that allows users to change their account name and password. This page contains JavaScript that confirms the user's current password before allowing changes. However, the JavaScript includes the current user's password in plaintext.

Recommendations: For TOTOLINK A3002RU version 1.0.8, consider disabling access to the password.htm page until a fix is available to prevent potential exploitation. Restricting the use of the password change functionality can minimize the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2018-13313

Affected Products

Totolink A3002Ru

References · 5

• 🔥 https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 · Exploit
• https://osv.dev/vulnerability/CVE-2018-13313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13313 · Security Note
• https://ise.io/casestudies/sohopelessly-broken-2-0 · Note
• https://t.me/cvenotify/1182 · Telegram Post