CVE-2024-7154 — Improper Access Control in A3700r

CWE-284 — Improper Access ControlCWE-306 — Missing Authentication for Critical Function3 documents3 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 74.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink A3700rTotolink A3700r Firmware
Timeline
PublishedJul 28

Description

A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. Affected is an unknown function of the file /wizard.html of the component Password Reset Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272568. NOTE: The vendor was contacted early about this disclosure but did not respond in an…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/a3700r9.1.2u.5822_B20200513
▶NVDtotolink/a3700r_firmware9.1.2u.5822_b20200513

🔴Vulnerability Details

2
CVEList
TOTOLINK A3700R Password Reset wizard.html access control↗2024-07-28
▶
GHSA
GHSA-9xpj-wgrg-m9r4: A vulnerability, which was classified as problematic, was found in TOTOLINK A3700R 9↗2024-07-28
▶
CVE-2024-7154 — Improper Access Control in A3700r | cvebase