TOTOLINK A3002R Firmware 1.1.1-B20200824
Approved changes feed: RSS · Atom
cpe:2.3:o:totolink:a3002r_firmware:1.1.1-b20200824:*:*:*:*:*:*:*
part: o version: 1.1.1-b20200824 update: *
| Vendor | Totolink (fa0129e6-aa24-5784-be77-22d8becdb79b) |
|---|---|
| Product | A3002R Firmware (60148191-7756-532d-9168-88651bbe56db) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-34195 |
vulnerable | 2026-06-08 06:37:33.037204 |
Details available
TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. In the boa server program's CGI handling function formWlEncrypt, there is a lack of length restriction on the wlan_ssid field. This oversight leads to potential buffer overflow under specific circumstances. For instance, by invoking the formWlanRedirect function with specific parameters to alter wlan_idx's value and subsequently invoking the formWlEncrypt function, an attacker can trigger buffer overflow, enabling arbitrary command execution or denial of service attacks.
Published: 2024-08-28T00:00:00.000Z
Updated: 2024-08-28T20:04:26.789Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34228 |
vulnerable | 2026-06-08 05:32:12.957875 |
Details available
Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field.
Published: 2021-08-20T16:49:24.000Z
Updated: 2024-08-04T00:05:52.473Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34223 |
vulnerable | 2026-06-08 05:32:12.957576 |
Details available
Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field.
Published: 2021-08-20T16:48:48.000Z
Updated: 2024-08-04T00:05:52.504Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34220 |
vulnerable | 2026-06-08 05:32:12.957259 |
Details available
Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "User Name" field or "Password" field.
Published: 2021-08-20T16:47:55.000Z
Updated: 2024-08-04T00:05:52.526Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34218 |
vulnerable | 2026-06-08 05:32:12.956826 |
Details available
Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directories via GET Parameter.
Published: 2021-08-20T16:46:09.000Z
Updated: 2024-08-04T00:05:52.447Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34215 |
vulnerable | 2026-06-08 05:32:12.956352 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-34207 |
vulnerable | 2026-06-08 05:32:12.955090 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.