In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.
References
Link | Resource |
---|---|
http://a3100r.com | Broken Link |
http://totolink.com | Vendor Advisory |
https://hackmd.io/vS-OfUEzSqqKh8e1PKce5A | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
History
05 Apr 2022, 19:05
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:h:totolink:a3100r:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:a3100r_firmware:5.9c.4577:*:*:*:*:*:*:* |
|
CWE | CWE-306 | |
CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
References | (MISC) https://hackmd.io/vS-OfUEzSqqKh8e1PKce5A - Exploit, Third Party Advisory | |
References | (MISC) http://a3100r.com - Broken Link | |
References | (MISC) http://totolink.com - Vendor Advisory |
30 Mar 2022, 23:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-03-30 23:15
Updated : 2024-02-04 22:29
NVD link : CVE-2021-46006
Mitre link : CVE-2021-46006
CVE.ORG link : CVE-2021-46006
JSON object : View
Products Affected
totolink
- a3100r
- a3100r_firmware
CWE
CWE-306
Missing Authentication for Critical Function