TOTOLINK CA300-PoE 命令注入漏洞

The TOTOLINK CA300-PoE is a wireless access point from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK CA300-PoE version V6.2c.884 due to a command injection issue in the pluginversion parameter of the setUnloadUserData method...

PT-2023-1539

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description The issue is related to the lack of input sanitization in the NTPSyncWithHost function of the TOTOLINK CA300-PoE router's firmware. This can be exploited by a remote attacker to execute arbitrary...

PT-2023-19436

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description A command injection issue was discovered via the FileName parameter in the setUploadUserData function. This allows for potential command injection attacks. Recommendations For TOTOLINK CA300-PoE...

PT-2023-19429

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description A command injection issue was discovered via the NetDiagPingNum parameter in the setNetworkDiag function. This allows for potential command injection attacks. Recommendations For TOTOLINK CA300-P...

PT-2023-19430

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description A command injection issue was discovered via the NetDiagPingTimeOut parameter in the setNetworkDiag function. This allows for potential command injection attacks. Recommendations For TOTOLINK...

PT-2023-19437

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description The issue concerns a hard-coded password for the root user, which is stored in the /etc/shadow component. This could potentially allow unauthorized access to the system. Recommendations For...

PT-2023-19432

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description A command injection issue was discovered via the NetDiagTracertHop parameter in the setNetworkDiag function. This allows for potential command injection attacks. Recommendations For TOTOLINK...

PT-2023-1540 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: The issue is related to the use of hardcoded credentials in the /etc/config/product.ini component of the TOTOLINK CA300-PoE router's firmware. This could allow a remote attacker to disclose...

PT-2023-19433

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description A command injection issue was found via the hour parameter in the setRebootScheCfg function, allowing for potential command injection attacks. Recommendations For TOTOLINK CA300-PoE version...

PT-2023-19431

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description A command injection issue was discovered via the NetDiagPingSize parameter in the setNetworkDiag function. This allows for potential command injection attacks. Recommendations For TOTOLINK...

PT-2023-19427

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description A command injection issue was discovered via the NetDiagHost parameter in the setNetworkDiag function. This allows for potential command injection attacks. Recommendations For TOTOLINK CA300-PoE...