CVE-2018-13316

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-11-27

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• A3002ru Firmware (Totolink)

References

• https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154