Totolink A3002Ru Firmware vulnerabilities

CVE-2018-13313 [MEDIUM] CWE-922 CVE-2018-13313: In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account n In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.

CVE-2025-5506 [MEDIUM] CWE-79 CVE-2025-5506: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as proble A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been classified as problematic. Affected is an unknown function of the component NAT Mapping Page. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-5507 [MEDIUM] CWE-79 CVE-2025-5507: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problema A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public

CVE-2018-13309 [MEDIUM] CWE-79 CVE-2018-13309: Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute a Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.

CVE-2018-13310 [MEDIUM] CWE-79 CVE-2018-13310: Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute a Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.

CVE-2018-13312 [MEDIUM] CWE-79 CVE-2018-13312: Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.

CVE-2018-13308 [MEDIUM] CWE-79 CVE-2018-13308: Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.

CVE-2025-5508 [LOW] CWE-79 CVE-2025-5508: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011. It has been rated as problematic. Affected by this issue is some unknown functionality of the component IP Port Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may

CVE-2025-5505 [LOW] CWE-79 CVE-2025-5505: A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic. Th A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic. This issue affects some unknown processing of the file /boafrm/formPortFw of the component Virtual Server Page. The manipulation of the argument service_type leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed t