CVE Catalog
CVE-2021-46009
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk12.25%
96th percentile - higher than 96% of all known CVEs
Summary
In Totolink A3100R V5.9c.4577, multiple pages can be read without authentication using curl or Burp Suite. Additionally, admin configurations can be set without requiring cookies.
Risk Assessment
An attacker can gain unauthorized access to sensitive configuration data and modify admin settings, potentially leading to full compromise of the router.
Recommendation
Immediately update the router firmware to the latest available version. If no update is available, restrict management interface access to trusted networks only.
Original NVD description (English source)
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.