CVE-2018-13312: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...

CVE-2018-13311: Improper Neutralization of Special Elements used in an OS Command

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter...

PT-2018-11735

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue concerns system command injection in the formDlna of TOTOLINK A3002RU, allowing attackers to execute system commands. This is achieved via the sambaUser POST parameter. Recommendations For...

PT-2018-11740

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to obtain the plaintext password for the admin user by making a GET request for "password.htm". This affects the security of the device as it potentially exposes the admin...

PT-2018-11736

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the Input your notice URL field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK...

CVE-2018-13308: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field...

CVE-2018-13315: Improper Input Validation

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

PT-2018-11731

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript by modifying the User phrases button field in notice gen.htm, potentially leading to cross-site scripting. Recommendations For TOTOLINK A3002...

PT-2018-11738

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue is related to incorrect access control in the formPasswordSetup function, allowing attackers to change the admin user's password via an unauthenticated POST request to the /formPasswordSetup...

PT-2018-11734

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript via the user's username. This is a result of cross-site scripting in the password.htm file. Recommendations For TOTOLINK A3002RU version 1.0....

PT-2018-11732

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue allows attackers to execute arbitrary JavaScript via the user's password, specifically through cross-site scripting in the password.htm file. Recommendations For TOTOLINK A3002RU version...

CVE-2018-13309: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...

CVE-2018-13317: Improper Neutralization of Input During Web Page Generation

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...