CVEbuzz logo
This website displays data collected from external sources, and is not responsible for any aspect of it. Read more...

Security / vulnerability advisories for TOTOLINK A720r Firmware 4.1.5cu.470 B20200911

Titles listed in dictionary

CPE for product: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Showing 1-13 of 13
Maximal damage 9.8
Very easy to exploit
(other affected products) Published: Fri Feb 4 02:15:00 2022 UTC. Last Modified: Fri Feb 4 22:18:00 2022 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSSv3)

Type of bug(s)

References

Maximal damage 9.8
Very easy to exploit
(other affected products) Published: Fri Feb 4 02:15:00 2022 UTC. Last Modified: Fri Feb 4 22:00:00 2022 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the pin parameter.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSSv3)

Type of bug(s)

References

Medium damage 7.5
Very easy to exploit
(other affected products) Published: Fri Feb 4 02:15:00 2022 UTC. Last Modified: Fri Feb 4 22:00:00 2022 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSSv3)

Type of bug(s)

References

Medium damage 7.5
Very easy to exploit
(other affected products) Published: Fri Feb 4 02:15:00 2022 UTC. Last Modified: Fri Feb 4 22:18:00 2022 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSSv3)

Type of bug(s)

References

Maximal damage 9.8
Very easy to exploit
(other affected products) Published: Fri Feb 4 02:15:00 2022 UTC. Last Modified: Mon Feb 7 14:19:00 2022 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom parameter.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSSv3)

Type of bug(s)

References

Medium damage 7.5
Very easy to exploit
(other affected products) Published: Fri Feb 4 02:15:00 2022 UTC. Last Modified: Wed Feb 9 03:12:00 2022 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain a stack overflow in the function setNoticeCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IpTo parameter.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSSv3)

Type of bug(s)

References

Medium damage 6.5
Easy to exploit
(other affected products) Published: Thu Mar 31 00:15:00 2022 UTC. Last Modified: Tue Apr 5 19:13:00 2022 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSSv3)

Type of bug(s)

References

Maximal damage 9.8
Very easy to exploit
(other affected products) Published: Thu Aug 5 21:15:00 2021 UTC. Last Modified: Thu Aug 12 18:33:00 2021 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSSv3)

Type of bug(s)

References

Medium damage 7.5
Very easy to exploit
(other affected products) Published: Thu Aug 5 21:15:00 2021 UTC. Last Modified: Thu Aug 12 18:31:00 2021 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (CVSSv3)

References

Medium damage 7.5
Very easy to exploit
(other affected products) Published: Thu Aug 5 21:15:00 2021 UTC. Last Modified: Thu Aug 12 18:28:00 2021 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSSv3)

Type of bug(s)

References

Maximal damage 9.8
Very easy to exploit
(other affected products) Published: Thu Aug 5 21:15:00 2021 UTC. Last Modified: Thu Aug 12 18:26:00 2021 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSSv3)

Type of bug(s)

References

Maximal damage 9.8
Very easy to exploit
(other affected products) Published: Wed Apr 14 18:15:00 2021 UTC. Last Modified: Wed Apr 21 15:41:00 2021 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "ip" parameter is directly passed to the attacker, allowing them to control the "ip" field to attack the OS.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSSv3)

Type of bug(s)

References

Maximal damage 9.8
Very easy to exploit
(other affected products) Published: Wed Apr 14 16:15:00 2021 UTC. Last Modified: Wed Apr 21 15:38:00 2021 UTC
CPE matches: cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.470_b20200911:*:*:*:*:*:*:*

Description

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function, "command" parameter is directly passed to the attacker, allowing them to control the "command" field to attack the OS.

Damage

Attack conditions

Damage and attack conditions obtained from CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSSv3)

Type of bug(s)

References