CVE Vulnerability

totolink

CVE-2018-13312

by

Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the “Input your notice URL” field.

CVE-2018-13311

by

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “sambaUser” POST parameter.

CVE-2018-13310

by

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user’s username.

CVE-2018-13308

by

Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the “User phrases button” field.

CVE-2018-13307

by

System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “ntpServerIp2” POST parameter. Certain payloads cause the device to become permanently inoperable.

CVE-2018-13306

by

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the “ftpUser” POST parameter.