PT-2022-12502 · Totolink · Totolink A3100R

Kv · Published 2022-03-30 · Updated 2022-04-05 · CVE-2021-46010

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Totolink A3100R version 5.9c.4577

Description The issue concerns the use of insufficiently random values via the web configuration, making the SESSION ID predictable. This predictability allows an attacker to hijack a valid session and conduct further malicious operations.

Recommendations For Totolink A3100R version 5.9c.4577, consider restricting access to the web configuration until a patch is available to minimize the risk of session hijacking. As a temporary workaround, avoid using the predictable SESSION ID in the affected web configuration endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2021-46010

Affected Products

Totolink A3100R

References · 6

• 🔥 https://hackmd.io/Ynwm8NnQSiK0xm7QKuNteg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-46010 · Security Note
• https://osv.dev/vulnerability/CVE-2021-46010 · Vendor Advisory
• http://totolink.com · Vendor Advisory
• http://a3100r.com · Note
• https://t.me/cibsecurity/39882 · Telegram Post