CVE Vulnerability

a3002ru_firmware

CVE-2018-13317

by

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.

CVE-2018-13306

by

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “ftpUser” POST parameter.

CVE-2018-13307

by

System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “ntpServerIp2” POST parameter. Certain payloads cause the device to become permanently inoperable.

CVE-2018-13308

by

Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the “User phrases button” field.

CVE-2018-13309

by

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user’s password.

CVE-2018-13310

by

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user’s username.