CVEvulnerability

CVE-2020-25499

8.8 HIGH Published 2020-12-09 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-12-09
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses
CWE-78, CWE-862

Description

TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.

Affected configurations

• totolink a3002r firmware (< 1.1.1-b20200824.0128) • totolink a3002ru-v1 firmware (< 3.4.0-b20201030.1754) • totolink a3002ru-v2 firmware (< 2.1.1-b20200911.1756) • totolink a702r-v2 firmware (< 1.0.0-b20201028.1743) • totolink a702r-v3 firmware (< 1.0.0-b20201103.1713) • totolink n100re-v3 firmware (< 3.4.0-b20201030.0926) • totolink n150rt firmware (< 3.4.0-b20201030.1142) • totolink n200re-v3 firmware (< 3.4.0-b20201029.1811) • totolink n200re-v4 firmware (< 4.0.0-b20200805.1507) • totolink n210re firmware (< 1.0.0-b20201030.2030) • totolink n300rh-v3 firmware (< 3.2.4-b20201029.1838) • totolink n300rt firmware (< 3.4.0-b20201026.2033) • totolink n302r plus firmware (< 3.4.0-b20201028.2224)

Related

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-862 Missing Authorization weakness

References