CVSS: 10.0EPSS: 4%CPEs: 2EXPL: 1CVE-2024-23057
https://notcve.org/view.php?id=CVE-2024-23057
11 Jan 2024 — TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function. Se descubrió que TOTOLINK A3300R V17.0.0cu.557_B20221024 contiene una vulnerabilidad de inyección de comandos a través del parámetro tz en la función setNtpCfg. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/5/TOTOlink%20A3300R%20setNtpCfg.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 4%CPEs: 2EXPL: 1CVE-2024-23058
https://notcve.org/view.php?id=CVE-2024-23058
11 Jan 2024 — TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function. Se descubrió que TOTOLINK A3300R V17.0.0cu.557_B20221024 contiene una vulnerabilidad de inyección de comando a través del parámetro pass en la función setTr069Cfg. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/6/TOTOlink%20A3300R%20setTr069Cfg.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 4%CPEs: 2EXPL: 1CVE-2024-23059
https://notcve.org/view.php?id=CVE-2024-23059
11 Jan 2024 — TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function. Se descubrió que TOTOLINK A3300R V17.0.0cu.557_B20221024 contiene una vulnerabilidad de inyección de comando a través del parámetro username en la función setDdnsCfg. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/2/TOTOlink%20A3300R%20setDdnsCfg.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 4%CPEs: 2EXPL: 1CVE-2024-23060
https://notcve.org/view.php?id=CVE-2024-23060
11 Jan 2024 — TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function. Se descubrió que TOTOLINK A3300R V17.0.0cu.557_B20221024 contiene una vulnerabilidad de inyección de comandos a través del parámetro ip en la función setDmzCfg. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/4/TOTOLINK%20A3300R%20setDmzCfg.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 4%CPEs: 2EXPL: 1CVE-2024-23061
https://notcve.org/view.php?id=CVE-2024-23061
11 Jan 2024 — TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function. Se descubrió que TOTOLINK A3300R V17.0.0cu.557_B20221024 contiene una vulnerabilidad de inyección de comandos a través del parámetro de minute en la función setScheduleCfg. • https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/3/TOTOLINK%20A3300R%20setScheduleCfg.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-46992
https://notcve.org/view.php?id=CVE-2023-46992
31 Oct 2023 — TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authentication by visiting specific pages. TOTOLINK A3300R V17.0.0cu.557_B20221024 es vulnerable a un control de acceso incorrecto. Los atacantes pueden restablecer varias contraseñas críticas sin autenticación visitando páginas específicas. • https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R/readme.md • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 51%CPEs: 2EXPL: 1CVE-2023-46976
https://notcve.org/view.php?id=CVE-2023-46976
31 Oct 2023 — TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function. TOTOLINK A3300R 17.0.0cu.557_B20221024 contiene una inyección de comando a través del parámetro file_name en la función UploadFirmwareFile. • https://github.com/shinypolaris/vuln-reports/blob/master/TOTOLINK%20A3300R/1/README.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 51%CPEs: 2EXPL: 1CVE-2023-46993
https://notcve.org/view.php?id=CVE-2023-46993
31 Oct 2023 — In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection. En TOTOLINK A3300R V17.0.0cu.557_B20221024, cuando se trata de la solicitud setLedCfg, no hay verificación para el parámetro enable, lo que puede provocar la inyección de un comando. • https://github.com/AuroraHaaash/vul_report/blob/main/TOTOLINK%20A3300R-Command%20Injection/readme.md • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-37170
https://notcve.org/view.php?id=CVE-2023-37170
07 Jul 2023 — TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function. • https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_1 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2023-37171
https://notcve.org/view.php?id=CVE-2023-37171
07 Jul 2023 — TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function. • https://github.com/kafroc/Vuls/tree/main/TOTOLINK/A3300R/cmdi_2 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •