cbcvebase.
CVE-2018-13317
published 2018-11-26

CVE-2018-13317: Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET…

PriorityP277medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.99%
58.6th percentile
Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm.

Affected

1 ranges
VendorProductVersion rangeFixed in
totolinka3002ru_firmware——

Detection & IOCsextracted from sources · hover to see the quote

path/password.htm↗
commandGET /password.htm↗
yara
regex: orgpassword=[^&\s]+"
  • →Send an unauthenticated HTTP GET request to /password.htm on the target device; a vulnerable response will contain both 'orgpassword=' and 'orgusername=' parameters with non-empty values in the response body.
  • →A non-vulnerable or patched device will return 'orgpassword=\'\'\'' (empty password field) in the body; use this as a negative matcher to avoid false positives.
  • →FOFA fingerprinting query 'title="totolink"' can be used to identify potentially exposed TOTOLINK devices on the internet for mass scanning.
  • →The vulnerability requires no authentication (PR:N) and no user interaction beyond the GET request; any HTTP 200 response containing orgpassword and orgusername regex matches confirms exploitation.
  • ·Vulnerability is specific to TOTOLINK A3002RU firmware version 1.0.8 only; other firmware versions may not be affected. ↗
  • ·Detection requires exactly one HTTP request (max-requests: 1), making it a low-noise, single-probe check suitable for large-scale scanning.

CVSS provenance

nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.