Details of VAR-202203-1590

ID

VAR-202203-1590

CVE

CVE-2021-43662

TITLE

TOTOLINK of ex300 v2 firmware and A720R Unlimited or Throttling Resource Allocation Vulnerability in Firmware

Trust: 0.8

sources: JVNDB: JVNDB-2021-019070

DESCRIPTION

totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption. TOTOLINK of ex300 v2 firmware and A720R A vulnerability exists in the firmware regarding resource allocation without limits or throttling.Service operation interruption (DoS) It may be in a state. TotoLink EX300 is a 300 Mbps wireless N range extender from TotoLink in China. TotoLink A720R is a gigabit dual-band wireless wifi amplifier from China TotoLink company. TotoLink EX300_v2 and A720R have a resource management error vulnerability that could be exploited by an attacker to run out of storage space, resulting in a DoS condition

Trust: 2.16

sources: NVD: CVE-2021-43662 // JVNDB: JVNDB-2021-019070 // CNVD: CNVD-2022-54655

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2022-54655

AFFECTED PRODUCTS

vendor:	totolink	model:	a720r	scope:	eq	version:	4.1.5cu.470_b20200911	Trust: 1.0
vendor:	totolink	model:	ex300 v2	scope:	eq	version:	4.0.3c.140_b20210429	Trust: 1.0
vendor:	totolink	model:	ex300 v2	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a720r	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a720r ver v4.1.5cu.470 b20200911	scope:	-	version:	-	Trust: 0.6
vendor:	totolink	model:	ex300 v2 v4.0.3c.140 b20210429	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2022-54655 // JVNDB: JVNDB-2021-019070 // NVD: CVE-2021-43662

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-43662
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2021-43662
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2022-54655
value:	LOW
Trust: 0.6
CNNVD:	CNNVD-202203-2616
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2021-43662
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2022-54655
severity:	LOW
baseScore:	3.3
vectorString:	AV:A/AC:L/AU:N/C:N/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2021-43662
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2021-43662
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2022-54655 // JVNDB: JVNDB-2021-019070 // CNNVD: CNNVD-202203-2616 // NVD: CVE-2021-43662

PROBLEMTYPE DATA

problemtype:	CWE-770	Trust: 1.0
problemtype:	Allocation of resources without limits or throttling (CWE-770) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2021-019070 // NVD: CVE-2021-43662

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202203-2616

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202203-2616

EXTERNAL IDS

db:	NVD	id:	CVE-2021-43662	Trust: 3.8
db:	JVNDB	id:	JVNDB-2021-019070	Trust: 0.8
db:	CNVD	id:	CNVD-2022-54655	Trust: 0.6
db:	CNNVD	id:	CNNVD-202203-2616	Trust: 0.6

sources: CNVD: CNVD-2022-54655 // JVNDB: JVNDB-2021-019070 // CNNVD: CNNVD-202203-2616 // NVD: CVE-2021-43662

REFERENCES

url:	https://github.com/chibataiki/iot-vuls/blob/main/totolink/dos.md	Trust: 3.0
url:	https://nvd.nist.gov/vuln/detail/cve-2021-43662	Trust: 1.4
url:	https://cxsecurity.com/cveshow/cve-2021-43662/	Trust: 0.6

sources: CNVD: CNVD-2022-54655 // JVNDB: JVNDB-2021-019070 // CNNVD: CNNVD-202203-2616 // NVD: CVE-2021-43662

SOURCES

db:	CNVD	id:	CNVD-2022-54655
db:	JVNDB	id:	JVNDB-2021-019070
db:	CNNVD	id:	CNNVD-202203-2616
db:	NVD	id:	CVE-2021-43662

LAST UPDATE DATE

2024-11-23T21:50:38.877000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2022-54655	date:	2022-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2021-019070	date:	2023-07-14T08:39:00
db:	CNNVD	id:	CNNVD-202203-2616	date:	2022-07-14T00:00:00
db:	NVD	id:	CVE-2021-43662	date:	2024-11-21T06:29:34.157

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2022-54655	date:	2022-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2021-019070	date:	2023-07-14T00:00:00
db:	CNNVD	id:	CNNVD-202203-2616	date:	2022-03-30T00:00:00
db:	NVD	id:	CVE-2021-43662	date:	2022-03-31T00:15:07.987