CVE-2021-46009

9.8 criticalEPSS 13%

Critical (9.8) in totolink a3100r firmware. EPSS 13% chance of exploitation in the next 30 days.

In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2022-03-30
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

totolink:a3100r_firmware

References

https://hackmd.io/-riYp6Q-ReCx-dKKWFBTLg
https://hackmd.io/-riYp6Q-ReCx-dKKWFBTLg

Check your stack JSON