Critical severity · published Mar 30, 2022
CVE-2021-46009
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication
9.8
CVSS
12.5%
EPSS
No
On KEV
Description
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)12.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
A3100r Firmware · Totolink
5.9c.4577 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-46009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-46009
Exploit
https://hackmd.io/-riYp6Q-ReCx-dKKWFBTLg
More from A3100r Firmware
9.8
CVE-2025-4496
TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow
9.8
CVE-2025-45790
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so
9.8
CVE-2025-45787
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules
9.8
CVE-2025-45788
TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules
9.8
CVE-2025-45789
TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules