CVE-2022-29646 - OpenCVE

An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Totolink	A3100r A3100r Firmware

Configuration 1 [-]

AND

OR	cpe:2.3:o:totolink:a3100r_firmware:4.1.2cu.5050_b20200504:::::::*
	cpe:2.3:o:totolink:a3100r_firmware:4.1.2cu.5247_b20211129:::::::*

cpe:2.3:h:totolink:a3100r:-:*:*:*:*:*:*:*

References

Link	Resource
https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/9.md	Exploit Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2022-05-18T11:50:52

Updated: 2022-05-18T11:50:52

Reserved: 2022-04-25T00:00:00

Link: CVE-2022-29646

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-05-18T12:15:08.580

Modified: 2022-05-26T17:21:09.450

Link: CVE-2022-29646

JSON object: View

Redhat Information

No data.

CWE

CWE-668

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:totolink:a3100r_firmware:4.1.2cu.5050_b20200504:*:*:*:*:*:*:*", "matchCriteriaId": "0BD0B6FC-5C4F-4547-883D-7B9C03B45523", "vulnerable": true}, {"criteria": "cpe:2.3:o:totolink:a3100r_firmware:4.1.2cu.5247_b20211129:*:*:*:*:*:*:*", "matchCriteriaId": "9098D12E-0A3B-4CBF-AC5E-43C5394C7719", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:totolink:a3100r:-:*:*:*:*:*:*:*", "matchCriteriaId": "40729E79-9D89-440F-B38D-E62D310E27F9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request."}, {"lang": "es", "value": "Un problema de control de acceso en TOTOLINK A3100R V4.1.2cu.5050_B20200504 y V4.1.2cu.5247_B20211129 permite a atacantes obtener informaci\u00f3n confidencial por medio de una petici\u00f3n web dise\u00f1ada"}], "id": "CVE-2022-29646", "lastModified": "2022-05-26T17:21:09.450", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-18T12:15:08.580", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/shijin0925/IOT/blob/master/TOTOLINK%20A3100R/9.md"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "nvd@nist.gov", "type": "Primary"}]}