PT-2022-12501 · Totolink · Totolink A3100R

Kv · Published 2022-03-30 · Updated 2022-04-05 · CVE-2021-46009

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Totolink A3100R version 5.9c.4577

Description The issue allows multiple pages to be read without authentication using tools like curl or Burp Suite. Furthermore, admin configurations can be set without the need for cookies.

Recommendations For Totolink A3100R version 5.9c.4577, consider restricting access to sensitive pages and configurations to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the device for sensitive operations that require authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-46009

Affected Products

Totolink A3100R

References · 6

• 🔥 https://hackmd.io/-riYp6Q-ReCx-dKKWFBTLg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46009 · Security Note
• http://totolink.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46009 · Vendor Advisory
• http://a3100r.com · Note
• https://t.me/cibsecurity/39896 · Telegram Post