Totolink

A3002ru Firmware

47 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2018-13308

Exploit
  • EPSS 0.21%
  • Published 26.11.2018 23:29:00
  • Last modified 21.11.2024 03:46:49

Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.

6.1

CVE-2018-13317

Exploit
  • EPSS 0.21%
  • Published 26.11.2018 23:29:00
  • Last modified 21.11.2024 03:46:51

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.

9.8

CVE-2018-13315

Exploit
  • EPSS 0.97%
  • Published 26.11.2018 23:29:00
  • Last modified 21.11.2024 03:46:51

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request.

6.1

CVE-2018-13312

Exploit
  • EPSS 0.21%
  • Published 26.11.2018 23:29:00
  • Last modified 21.11.2024 03:46:51

Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.

10

CVE-2018-13311

  • EPSS 6.48%
  • Published 26.11.2018 23:29:00
  • Last modified 21.11.2024 03:46:50

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter.

6.1

CVE-2018-13310

  • EPSS 0.21%
  • Published 26.11.2018 23:29:00
  • Last modified 21.11.2024 03:46:50

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.

6.1

CVE-2018-13309

Exploit
  • EPSS 0.21%
  • Published 26.11.2018 23:29:00
  • Last modified 21.11.2024 03:46:49

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.