CVE-2018-13309

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8

Description The issue allows attackers to execute arbitrary JavaScript via the user's password, specifically through cross-site scripting in the password.htm file.

Recommendations For TOTOLINK A3002RU version 1.0.8, consider updating to a newer version that addresses this issue, if available. As a temporary workaround, restrict access to the password.htm file to minimize the risk of exploitation. Avoid using the password variable in the affected API endpoint until the issue is resolved.