CVE-2021-34207: XSS

Published Aug 20, 2021

Updated

Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Domain Name" field, "Server Address" field, "User Name/Email", or "Password/Key" field.

Affected Software

2 affected components

TOTOLINK A3002R Firmware=1.1.1-b20200824

TOTOLINK A3002R

Event History

Aug 20, 2021

CVE Published

via MITRE·04:43 PM

Data Sourced

via MITRE·04:43 PM

Description

Frequently Asked Questions

What is CVE-2021-34207?

CVE-2021-34207 is a vulnerability that refers to a cross-site scripting (XSS) issue in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824.

How does CVE-2021-34207 affect TOTOLINK A3002R?

CVE-2021-34207 allows attackers to execute arbitrary JavaScript by modifying various fields in the TOTOLINK A3002R web interface.

What is the severity of CVE-2021-34207?

The severity of CVE-2021-34207 is medium, with a severity value of 6.1.

How can I fix CVE-2021-34207 on my TOTOLINK A3002R device?

To fix CVE-2021-34207 on your TOTOLINK A3002R device, you should update to a version of the firmware that includes the security patch provided by TOTOLINK.

Where can I find more information about CVE-2021-34207?

You can find more information about CVE-2021-34207, including technical details and mitigation strategies, on the GitHub page: https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R.