PT-2022-22868 · Totolink · Totolink A3002Ru

Published 2022-08-09 · Updated 2022-08-12 · CVE-2022-35491

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version V3.0.0-B20220304.1804

Description The issue concerns a hardcoded password for the root user, located in the /etc/shadow.sample file.

Recommendations For TOTOLINK A3002RU version V3.0.0-B20220304.1804, consider changing the hardcoded password for the root user in the /etc/shadow.sample file to a unique and secure password. As a temporary workaround, restrict access to the root account until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-35491

Affected Products

Totolink A3002Ru

References · 3

• https://osv.dev/vulnerability/CVE-2022-35491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35491 · Security Note
• https://github.com/1337536723/iot/blob/main/totolink/A3002RU.md · Note