CVE-2022-29641
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
TOTOLINK A3100R routers with firmware versions V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were found to have a stack overflow vulnerability. The issue occurs in the setParentalRules function via the startTime and endTime parameters, allowing an attacker to cause a Denial of Service (DoS) through a crafted POST request.
Risk Assessment
An attacker can remotely crash the router, leading to network disruption and loss of internet access for all connected devices.
Recommendation
Immediately update the TOTOLINK A3100R router firmware to the latest available version that fixes this vulnerability. If no update is available, restrict access to the router's management interface to trusted networks only.
Other vulnerabilities in TOTOLINK A3100R
See all- CVE-2021-46009Critical
In Totolink A3100R V5.9c.4577, multiple pages can be read without authentication using curl or Burp Suite. Additionally, admin configurations can be set without requiring cookies.
- CVE-2021-46007Critical
The Totolink A3100R router with firmware version V5.9c.4577 is vulnerable to OS command injection. The ping function in the admin panel does not properly filter special characters, allowing an attacker to execute arbitrary commands.
- CVE-2021-46006Medium
In Totolink A3100R firmware version V5.9c.4577, the test.asp file exposes an unauthenticated API-like function. This allows an attacker to modify multiple device settings without any authentication.
- CVE-2021-44620Critical
A command injection vulnerability exists in TOTOLINK A3100R up to version V4.1.2cu.5050_B20200504 in the adm/ntm.asp script via the hosTime parameter. It allows a remote attacker to execute arbitrary system commands on the device.
- CVE-2021-46010High
The Totolink A3100R router with firmware version V5.9c.4577 suffers from a vulnerability due to the use of insufficiently random values in the web configuration. The SESSION_ID is predictable, allowing an attacker to hijack a valid session and conduct further malicious operations.
- CVE-2021-46008High
In the Totolink A3100R router with firmware version V5.9c.4577, a hard-coded Telnet password was discovered that can be extracted from the official firmware release. An attacker connected to the Wi-Fi can easily gain root shell access via Telnet if the service is enabled.
Original NVD description (English source)
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.