TotoLink 路由器 setting/getPasswordCfg 信息泄露漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.iotsec-zone.com/article/382
• https://blingblingxuanxuan.github.io/2021/09/25/analysis-of-totolink-t10/

Related Vulnerabilities

• TOTOLINK EX200 /cgi-bin/cstecgi.cgi setLanguageCfg 命令执行漏洞
• TOTOLINK EX200 /cgi-bin/cstecgi.cgi NTPSyncWithHost 命令执行漏洞
• PoCCVE-2018-13317: TOTOLINK A3002RU 1.0.8 - Information Disclosure
• PoCCVE-2019-19822: TOTOLINK/Realtek Routers - Information Disclosure
• PoCCVE-2019-19823: TOTOLINK/Realtek Routers - Information Disclosure
• PoCCVE-2019-19825: TOTOLINK/Realtek Routers - CAPTCHA Bypass
• PoCCVE-2019-19824: TOTOLINK Realtek SD Routers - Remote Command Injection
• PoCCVE-2021-42887: TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass
• PoCCVE-2022-25082: TOTOLink - Unauthenticated Command Injection
• PoCCVE-2023-30013: TOTOLink - Unauthenticated Command Injection
• PoCCVE-2023-46574: TOTOLINK A3700R - Command Injection
• PoCCVE-2024-24328: TotoLink Router setMacFilterRules - Command Injection
• PoCCVE-2024-24329: TotoLink Router setPortForwardRules - Command Injection