CVE-2018-13313 json
Admin Password returned in password.htm
published 2020-02-24 6 y ago modified 2026-06-17 4 mo ago also EUVD-2018-5261
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScript which is used to confirm the user knows their current password before allowing them to change their password. However, this JavaScript contains the current user’s password in plaintext.
Exploit prediction
1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- blog.securityevaluators.com https://blog.securityevaluators.com/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-922 Insecure Storage of Sensitive Information
References
-
blog.securityevaluators.com
/new-vulnerabilities-in-totolink-a3002ru-d6f42a081154
exploit, third-party-advisory
-
ise.io
/casestudies/sohopelessly-broken-2-0/
third-party-advisory
Sources
- CVE List CVE-2018-13313
- NVD CVE-2018-13313
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.