PT-2022-19745 · Totolink · Totolink A3100R

Hijin0925 · Published 2022-05-18 · Updated 2022-05-26 · CVE-2022-29641

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK A3100R versions V4.1.2cu.5050 B20200504 through V4.1.2cu.5247 B20211129

Description The issue is related to a stack overflow via the startTime and endTime parameters in the setParentalRules function, allowing attackers to cause a Denial of Service (DoS) via a crafted POST request to the affected API endpoint.

Recommendations For versions V4.1.2cu.5050 B20200504 through V4.1.2cu.5247 B20211129, consider disabling the setParentalRules function as a temporary workaround to prevent exploitation. Restrict access to the API endpoint that accepts startTime and endTime parameters to minimize the risk of Denial of Service (DoS) attacks.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-29641

Affected Products

Totolink A3100R

References · 5

• 🔥 https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/4.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-29641 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29641 · Security Note
• https://t.me/cibsecurity/42898 · Telegram Post
• http://totolink.com · Note