TOTOLINK A3600R Firmware 4.1.2cu.5182 B20201102

Totolink A3600R Parameter cstecgi.cgi setNoticeCfg command injection

TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste_modules/app.so. The vulnerability occurs because the rootSsid parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service.

Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample.

TOTOLINK A3600R cstecgi.cgi setdeviceName buffer overflow

TOTOLINK A3600R cstecgi.cgi setLanguageCfg buffer overflow

TOTOLINK A3600R cstecgi.cgi UploadCustomModule buffer overflow

TOTOLINK A3600R cstecgi.cgi setMacQos buffer overflow

TOTOLINK A3600R cstecgi.cgi setWiFiAclAddConfig buffer overflow

TOTOLINK A3600R cstecgi.cgi setWebWlanIdx buffer overflow

TOTOLINK A3600R cstecgi.cgi setUrlFilterRules buffer overflow

TOTOLINK A3600R cstecgi.cgi setUploadSetting buffer overflow

TOTOLINK A3600R cstecgi.cgi setUpgradeFW buffer overflow

TOTOLINK A3600R cstecgi.cgi setPortForwardRules buffer overflow

TOTOLINK A3600R cstecgi.cgi setParentalRules buffer overflow

TOTOLINK A3600R cstecgi.cgi setIpQosRules buffer overflow

TOTOLINK A3600R cstecgi.cgi loginauth buffer overflow

TOTOLINK A3600R getSaveConfig buffer overflow

Totolink A3600R app.so setAppEasyWizardConfig buffer overflow

TOTOLINK A3600R cstecgi.cgi setTelnetCfg command injection

TOTOLINK A3600R cstecgi.cgi setDiagnosisCfg os command injection

TOTOLINK A3600R cstecgi.cgi NTPSyncWithHost os command injection

TOTOLINK A3600R Telnet Service product.ini hard-coded password

TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi.

Totolink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a stacker overflow in the fread function at infostat.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via the parameter CONTENT_LENGTH.