Unauthenticated Configuration Manipulation in Totolink Router

CVE-2021-46006

Summary

The Totolink A3100R router has a significant security flaw in its 'test.asp' file, which features an API-like function that lacks proper authentication mechanisms. This vulnerability permits unauthorized users to change critical settings on the router without any form of authentication. As a result, attackers can exploit this weakness to manipulate network configurations, potentially leading to compromised system security and integrity.

References