CVE-2018-13317

MEDIUM EXPLOITED NUCLEI

Totolink A3002ru Firmware - XSS

Title source: rule

Description

Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.

Nuclei Templates (1)

TOTOLINK A3002RU 1.0.8 - Information Disclosure

MEDIUMVERIFIEDby ritikchaddha

FOFA: title="totolink"

References (1)

[Exploit, Third Party Advisory] https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154

Scores

CVSS v3 6.1

EPSS 0.0017

EPSS Percentile 38.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

VulnCheck KEV 2025-12-15

CWE

CWE-79

Status published

Products (1)

totolink/a3002ru_firmware 1.0.8

Published Nov 26, 2018

Tracked Since Feb 18, 2026