CVE-2021-34228

medium · 6.1

Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field.

6.1

CVSS

29.2%

EPSS (exploit prob.)

98th

EPSS percentile

2021-08-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
totolink	a3002r_firmware	1.1.1-b20200824
totolink	a3002r	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R
https://github.com/pup2y/IoTVul/tree/main/TOTOLINK/A3002R

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-34228