CVSS: 9.8EPSS: 8%CPEs: 2EXPL: 1CVE-2024-23057
https://notcve.org/view.php?id=CVE-2024-23057
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function. Se descubrió que TOTOLINK A3300R V17.0.0cu.557_B20221024 contiene una vulnerabilidad de inyección de comandos a través del parámetro tz en la función setNtpCfg. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/5/TOTOlink%20A3300R%20setNtpCfg.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-52029
https://notcve.org/view.php?id=CVE-2023-52029
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setDiagnosisCfg function. Se descubrió que TOTOlink A3700R v9.1.2u.5822_B20200513 contiene una vulnerabilidad de ejecución remota de comandos (RCE) a través de la función setDiagnosisCfg. • https://815yang.github.io/2023/12/04/a3700r/TOTOlink%20A3700R%28setDiagnosisCfg%29 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-52027
https://notcve.org/view.php?id=CVE-2023-52027
TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost function. Se descubrió que TOTOlink A3700R v9.1.2u.5822_B20200513 contiene una vulnerabilidad de ejecución remota de comandos (RCE) a través de la función NTPSyncWithHost. • https://815yang.github.io/2023/12/23/a3700r/TOTOLINKA3700R_NTPSyncWithHost • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-46025
https://notcve.org/view.php?id=CVE-2022-46025
Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page. Totolink N200RE_V5 V9.3.5u.6255_B20211224 es vulnerable a un control de acceso incorrecto. El dispositivo permite a atacantes remotos obtener información del sistema Wi-Fi, como el SSID y la contraseña de Wi-Fi, sin iniciar sesión en la página de administración. • https://pastebin.com/aan5jT40 • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-7223 – Totolink T6 cstecgi.cgi access control
https://notcve.org/view.php?id=CVE-2023-7223
A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://drive.google.com/file/d/1puSOo5XrzMrctw7EtrE7DnfssOOuhRTS/view?usp=sharing https://vuldb.com/?ctiid.249867 https://vuldb.com/?id.249867 • CWE-284: Improper Access Control •