PT-2022-19747 · Totolink · Totolink A3100R

Hijin0925 · Published 2022-05-18 · Updated 2022-05-26 · CVE-2022-29643

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TOTOLINK A3100R versions V4.1.2cu.5050 B20200504 through V4.1.2cu.5247 B20211129

Description The issue is a stack overflow that occurs via the macAddress parameter in the setMacQos function, allowing attackers to cause a Denial of Service (DoS) via a crafted POST request to the affected API endpoint.

Recommendations For versions V4.1.2cu.5050 B20200504 through V4.1.2cu.5247 B20211129, consider disabling the setMacQos function or restricting access to the macAddress parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-29643

Affected Products

Totolink A3100R

References · 4

• 🔥 https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/6.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-29643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29643 · Security Note
• https://t.me/cibsecurity/42892 · Telegram Post