| عنوان | TOTOLINK N600R v4.3.0cu.7866_B20220506 Use of Insufficiently Random Values |
|---|
| الوصف | TOTOLINK N600R firmware V4.3.0cu.7866_B20220506 generates the administrative session token (cookie_key) via md5(time(NULL)). The loginAuth handler in /web_cste/cgi-bin/cstecgi.cgi computes the token by executing "echo -n \"%ld\" | md5sum" where %ld is the Unix timestamp at login time. The resulting MD5 hash is stored in /tmp/cookie_key and used to authenticate all subsequent admin requests. An unauthenticated attacker on the LAN can brute-force the token by iterating over a narrow timestamp window (~86,400 candidates per 24h), compute md5(timestamp) for each, and hijack an active admin session to gain full control of the router (read Wi-Fi PSK, PPPoE credentials, modify DNS/firewall, flash firmware). See the linked repository for IDA Pro reverse engineering evidence, decompilation, and a working PoC. |
|---|
| المصدر | ⚠️ https://github.com/b1uerry/cves/tree/main/TOTOLINK/N600R/TOTOLINK_N600R_predictable-token |
|---|
| المستخدم | bluerry (UID 94916) |
|---|
| ارسال | 15/07/2026 11:57 AM (2 أشهر منذ) |
|---|
| الاعتدال | 29/08/2026 08:55 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397071 [TOTOLINK N600R 4.3.0cu.7866_B20220506 Authentication cstecgi.cgi loginAuth تشفير ضعيف] |
|---|
| النقاط | 20 |
|---|