CVE-2021-46006

MediumCVSS 6.5

Published: 30/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.38%

92th percentile - higher than 92% of all known CVEs

Summary

In Totolink A3100R firmware version V5.9c.4577, the test.asp file exposes an unauthenticated API-like function. This allows an attacker to modify multiple device settings without any authentication.

Risk Assessment

The risk is that an unauthenticated attacker can fully compromise the router, potentially altering network configuration, redirecting traffic, or stealing sensitive data.

Recommendation

Immediately update the router firmware to the latest available version. If no patch is provided by the vendor, consider replacing the device with a supported model.

Original NVD description (English source)

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.