Hardcoded Password Vulnerability in TOTOLINK A3002RU Router
CVE-2022-35491

9.8CRITICAL

Key Information:

Vendor
Totolink
Status
A3002ru Firmware
Vendor
CVE Published:
10 August 2022

Summary

The TOTOLINK A3002RU router version V3.0.0-B20220304.1804 is vulnerable due to a hardcoded password for the root user located in the /etc/shadow.sample file. This security flaw can potentially allow unauthorized access and manipulation of the device, leading to significant security risks. Users are encouraged to review their device's configuration and take necessary measures to secure their network.

References

https://github.com/1337536723/iot/blob/main/totolink/A300...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.