CVE-2018-13313

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.

En TOTOLINK A3002RU versión 1.0.8, el enrutador proporciona una página que permite al usuario cambiar su nombre de cuenta y contraseña. Esta página, password.htm, contiene JavaScript que es utilizado para confirmar que el usuario conozca su contraseña actual antes de permitirle cambiar su contraseña. Sin embargo, este JavaScript contiene la contraseña del usuario actual en texto plano.