changed 3 years ago  
Published Linked with GitHub

CVE-2021-46010

by KVS

  • Description
    The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.

  • Affected version
    Totolink A3100R V5.9c.4577

  • Root Cause Analysis
    The SESSION_ID is consist of 2:$TIMESTAMP:2, while $TIMESTAMP is the current timestamp. An attacker can brute force the possible timestamp after a valid login session.

  • Proof-of-Concept

    Image Not Showing Possible Reasons
    • The image file may be corrupted
    • The server hosting the image is unavailable
    • The image path is incorrect
    • The image format is not supported
    Learn More →

Select a repo