CVE-2021-46010

EUVD-2021-32716
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Affected Products (NVD)
VendorProductVersion
totolinka3100r_firmware
5.9c.4577:c.4577
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://a3100r.com
http://totolink.com
https://hackmd.io/Ynwm8NnQSiK0xm7QKuNteg
http://a3100r.com
http://totolink.com
https://hackmd.io/Ynwm8NnQSiK0xm7QKuNteg