CVE-2018-13306

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-11-27

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• A3002ru Firmware (Totolink)

References

• https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154