PT-2023-9693 · Totolink · Totolink A3300R

Published 2023-10-28 · Updated 2024-10-28 · CVE-2023-46992

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version 17.0.0cu.557 B20221024

Description The issue is related to incorrect access control, allowing attackers to reset critical passwords without authentication by visiting specific pages, such as /wizard.html or /phone/wizard.html. This can enable a remote attacker to bypass security restrictions and change the WiFi password.

Recommendations For TOTOLINK A3300R version 17.0.0cu.557 B20221024, consider restricting access to the /wizard.html and /phone/wizard.html pages until a patch is available. As a temporary workaround, limit the ability to reset critical passwords without proper authentication to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2024-10183

CVE-2023-46992

Affected Products

Totolink A3300R

References · 7

• 🔥 https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R/readme.md · Exploit
• https://bdu.fstec.ru/vul/2024-10183 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46992 · Security Note
• https://t.me/latest_high_impact_cve/79 · Telegram Post
• https://t.me/cvenotify/99788 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1719393144456798665 · Twitter Post