CVE-2018-13313: Admin Password returned in password.htm
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-13313?
CVE-2018-13313 is a vulnerability found in TOTOLINK A3002RU 1.0.8 router firmware.
What is the severity of CVE-2018-13313?
The severity of CVE-2018-13313 is medium with a severity score of 6.5.
How does CVE-2018-13313 affect TOTOLINK A3002RU 1.0.8?
CVE-2018-13313 allows an attacker to bypass the password change confirmation mechanism and change the account name and password.
Is TOTOLINK A3002RU 1.0.8 the only affected version?
Yes, TOTOLINK A3002RU 1.0.8 is the only affected version.
How can I fix CVE-2018-13313?
There is no official fix available for CVE-2018-13313 at the moment. It is recommended to update to the latest firmware version provided by TOTOLINK when it becomes available.