Show filters
30 Total Results
Displaying 11-20 of 30
Sort by:
Attacker Value
Unknown
CVE-2022-29641
Disclosure Date: May 18, 2022 (last updated February 23, 2025)
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
0
Attacker Value
Unknown
CVE-2022-29640
Disclosure Date: May 18, 2022 (last updated February 23, 2025)
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
0
Attacker Value
Unknown
CVE-2022-29639
Disclosure Date: May 18, 2022 (last updated February 23, 2025)
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a command injection vulnerability via the magicid parameter in the function uci_cloudupdate_config.
0
Attacker Value
Unknown
CVE-2022-29638
Disclosure Date: May 18, 2022 (last updated February 23, 2025)
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
0
Attacker Value
Unknown
CVE-2021-46010
Disclosure Date: March 30, 2022 (last updated February 23, 2025)
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.
0
Attacker Value
Unknown
CVE-2021-46009
Disclosure Date: March 30, 2022 (last updated February 23, 2025)
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.
0
Attacker Value
Unknown
CVE-2021-46008
Disclosure Date: March 30, 2022 (last updated February 23, 2025)
In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function turned on.
0
Attacker Value
Unknown
CVE-2021-46006
Disclosure Date: March 30, 2022 (last updated February 23, 2025)
In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.
0
Attacker Value
Unknown
CVE-2022-26214
Disclosure Date: March 15, 2022 (last updated February 23, 2025)
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the host_time parameter.
0
Attacker Value
Unknown
CVE-2022-26212
Disclosure Date: March 15, 2022 (last updated February 23, 2025)
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setDeviceName, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
0
