The vulnerability of the NTPSyncWithHost function in the microprogramming software for TOTOLINK CA300-PoE allows a hacker to execute any command they desire.

The vulnerability of the NTPSyncWithHost function in the TOTOLINK CA300-PoE router microprogramming system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through the hosttime parameter...

PT-2023-19434 · Totolink · Totolink Ca300-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA300-PoE version 6.2c.884 Description: A command injection issue was found via the plugin version parameter in the setUnloadUserData function. This allows for potential command injection attacks. Recommendations: For TOTOLINK...