CVE-2018-13313

Published: Feb 24, 2020Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.

Affected (1)

Products: Totolink: A3002ru Firmware

1 product

A3002ru Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Totolink A3002ru Firmware	Version 1.0.8

Running on/with	Platform Versions
Totolink A3002ru	All versions

Related CWEs

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

References (4)

https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.ise.io/casestudies/sohopelessly-broken-2-0/

Source: cve@mitre.org

Third Party Advisory

https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.ise.io/casestudies/sohopelessly-broken-2-0/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.