Note:
This project will be discontinued after December 13, 2021. [more]
Product:
A3002r_firmware
(Totolink)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 13 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2022-09-06 | CVE-2022-40111 | In TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 in the shadow.sample file, root is hardcoded in the firmware. | A3002r_firmware | 9.8 | ||
| 2022-09-06 | CVE-2022-40112 | TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable Buffer Overflow via the hostname parameter in binary /bin/boa. | A3002r_firmware | 7.5 | ||
| 2022-09-06 | CVE-2022-40110 | TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa. | A3002r_firmware | 7.5 | ||
| 2021-08-20 | CVE-2021-34207 | Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Domain Name" field, "Server Address" field, "User Name/Email", or "Password/Key" field. | A3002r_firmware | 6.1 | ||
| 2021-08-20 | CVE-2021-34215 | Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Service Name" field. | A3002r_firmware | 6.1 | ||
| 2021-08-20 | CVE-2021-34220 | Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "User Name" field or "Password" field. | A3002r_firmware | 6.1 | ||
| 2021-08-20 | CVE-2021-34218 | Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directories via GET Parameter. | A3002r_firmware | 5.3 | ||
| 2021-08-20 | CVE-2021-34223 | Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field. | A3002r_firmware | 6.1 | ||
| 2021-08-20 | CVE-2021-34228 | Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field. | A3002r_firmware | 6.1 | ||
| 2020-12-09 | CVE-2020-25499 | TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router. | A3002r_firmware, A3002ru\-V1_firmware, A3002ru\-V2_firmware, A702r\-V2_firmware, A702r\-V3_firmware, N100re\-V3_firmware, N150rt_firmware, N200re\-V3_firmware, N200re\-V4_firmware, N210re_firmware, N300rh\-V3_firmware, N300rt_firmware, N302r_plus_firmware | 8.8 |