PT-2023-30277 · Totolink · Totolink A3300R
CVE-2023-46976
·
Publicado
2023-10-31
·
Atualizado
2024-09-06
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TOTOLINK A3300R version 17.0.0cu.557 B20221024
Description
The issue concerns a command injection via the
file name parameter in the UploadFirmwareFile function.Recommendations
For TOTOLINK A3300R version 17.0.0cu.557 B20221024, avoid using the
file name parameter in the UploadFirmwareFile function until the issue is resolved. As a temporary workaround, consider restricting access to the UploadFirmwareFile function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Totolink A3300R