CVE-2020-27368

MEDIUM

TOTOLINK-A702R-V1.0.0-B20161227.1023 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-27368. PoCs published by swzhouu.

AI-analyzed exploit summary This repository documents a directory indexing vulnerability in TOTOLINK-A702R-V1.0.0-B20161227.1023, allowing unauthorized access to the /icons/ directory via a GET request. The PoC is a descriptive writeup with a screenshot, lacking executable exploit code.

Description

Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter.

Exploits (1)

nomisec WRITEUP 1 stars
by swzhouu · poc
https://github.com/swzhouu/CVE-2020-27368

This repository documents a directory indexing vulnerability in TOTOLINK-A702R-V1.0.0-B20161227.1023, allowing unauthorized access to the /icons/ directory via a GET request. The PoC is a descriptive writeup with a screenshot, lacking executable exploit code.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: TOTOLINK A702R (Firmware V1.0.0)
No auth needed
Prerequisites: Network access to the vulnerable device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/swzhouu/CVE-2020-27368

Scores

CVSS v3 5.5
EPSS 0.0045
EPSS Percentile 36.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-552
Status published
Products (1)
totolink/a702r_firmware 1.0.0-b20161227.1023
Published Jan 14, 2021
Tracked Since Feb 18, 2026