PT-2024-9868 · Totolink · Totolink A3002Ru

Published 2024-12-27 · Updated 2024-12-27

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Totolink A3002R (affected versions not specified)

Description: The issue is related to the formWsc function of the Totolink A3002R router's firmware, which fails to take measures to protect the web page structure. This can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted request.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-11646

Affected Products

Totolink A3002Ru

References · 2

• https://bdu.fstec.ru/vul/2024-11646 · Security Note
• https://github.com/MnrikSrins/totolink_A3002R_RCE/tree/main · Note