A3700r Firmware vulnerabilities
11 known vulnerabilities in A3700r Firmware from TOTOLINK. 11 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
A3700R: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be launched remot
- 8.2 High severity
A3700R: Incorrect Privilege Assignment
A vulnerability, which was classified as critical, has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. This issue affects the function setWiFiEasyCfg/setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component Password Handler. The manipulation
- 8.8 High severity
A3700R: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. It is possible to launch
- 7.5 High severity
A3700R: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513 and classified as problematic. Affected by this issue is some unknown functionality of the file /cgi-bin/ExportSettings.sh of the component apmib Configuration Handler. The manipulation leads t
- 7.5 High severity
A3700R: Missing Authentication for Critical Functionality
A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.html of the component Password Reset Handler. The manipulation leads to improper access controls. It i
- 9.8 Critical severity
a3700r_firmware: Improper Neutralization of Special Elements used in an OS Command
There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.
- 9.8 Critical severity
a3700r_firmware: Improper Neutralization of Special Elements used in a Command
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.
- 7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
- 7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
- 7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost.
- 7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg.