| tiêu đề | Totolink T8 V4.1.5cu.833_20220905 Broken Access Control |
|---|
| Mô tả | V4.1.5cu.833_20220905 of the device allows remote attackers to obtain Wi-Fi system information and modify system-related settings without logging in via port 80, path /cgi-bin/cstecgi.cgi, parameter topicurl.
This version does not verify that the administrator is logged in, so the attacker does not need to bring in the cookie obtained after the administrator has logged in, and can directly obtain the Wi-Fi SSID and Wi-Fi password.
Sending a request to modify the system settings without bringing in any cookies can modify the system settings, in a normal and secure situation it must be verified that the cookies are brought in after the administrator has logged in.
Totolink indicates the vulnerability has been fully patched in version 4.1.5cu.862_B20230228 and the latest patched version can be downloaded at https://download.totolink.tw/uploads/firmware/T8/TOTOLINK_T8_V4.1.5cu.862_B20230228.zip
|
|---|
| Nguồn | ⚠️ https://drive.google.com/file/d/1WSWrGEKUkvPk8hq1VRng-wbR7T6CknGY/view?usp=sharing |
|---|
| Người dùng | lin7lic (UID 39301) |
|---|
| Đệ trình | 08/01/2024 02:24 (cách đây 3 những năm) |
|---|
| Kiểm duyệt | 16/01/2024 08:06 (8 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 250785 [Totolink T8 4.1.5cu.833_20220905 Setting /cgi-bin/cstecgi.cgi getSysStatusCfg ssid/key tiết lộ thông tin] |
|---|
| điểm | 20 |
|---|