Bluerry

**Name of the Vulnerable Software and Affected Versions** TOTOLINK N600R version 4.3.0cu.7866 B20220506 **Description** An issue exists in the Authentication Handler component where the `loginAuth()` function within the '/web cste/cgi-bin/cstecgi.cgi' endpoint uses insufficiently random values. This weakness in the cryptographic assumption allows a remote attacker to potentially predict security-sensitive values generated during the authentication process, which may lead to unauthorized exposure. The attack is characterized by high complexity and difficult exploitability. **Recommendations** For version 4.3.0cu.7866 B20220506, disable internet-facing management, restrict administrative access to trusted networks, and place the management interface on an isolated VLAN. At the moment, there is no information about a newer version that contains a fix for this vulnerability.