CVE-2021-46006

6.5 mediumEPSS 5.5%

Medium (6.5) in totolink a3100r firmware. EPSS 5.5% chance of exploitation in the next 30 days.

In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 5.5% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2022-03-30
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

totolink:a3100r_firmware

References

https://hackmd.io/vS-OfUEzSqqKh8e1PKce5A
https://hackmd.io/vS-OfUEzSqqKh8e1PKce5A

Check your stack JSON