CVE-2021-46006

MEDIUM

Totolink A3100R V5.9c.4577 - Unauthenticated Configuration Modification via test.asp

Title source: llm
STIX 2.1

Description

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.

References (3)

Core 3
Core References
Vendor Advisory x_refsource_misc
http://totolink.com
Broken Link x_refsource_misc
http://a3100r.com
Exploit, Third Party Advisory x_refsource_misc
https://hackmd.io/vS-OfUEzSqqKh8e1PKce5A

Scores

CVSS v3 6.5
EPSS 0.0024
EPSS Percentile 46.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-306
Status published
Products (1)
totolink/a3100r_firmware 5.9c.4577
Published Mar 30, 2022
Tracked Since Feb 18, 2026