PT-2023-30279 · Totolink · Totolink X6000R

Published 2023-10-31 · Updated 2024-09-06 · CVE-2023-46978

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R version 9.4.0cu.852 B20230719

Description The issue concerns incorrect access control, allowing attackers to reset login and WIFI passwords without proper authentication.

Recommendations For TOTOLINK X6000R version 9.4.0cu.852 B20230719, consider restricting access to the password reset functionality until a fix is available. As a temporary workaround, changing the default login credentials and WIFI passwords to strong, unique ones may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-46978

Affected Products

Totolink X6000R

References · 4

• 🔥 https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20X6000R/1/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-46978 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46978 · Vendor Advisory
• https://t.me/latest_high_impact_cve/77 · Telegram Post