TOTOLINK - XSS (CVE-2018-13317)

CVE-2018-13317 is a vulnerability in TOTOLINK A3002RU version 1.0.8 that exposes the admin user's plaintext password through a simple GET request to password.htm. This flaw could allow remote attackers to easily obtain administrative credentials and potentially take control of the device, leading to unauthorized configuration changes or further network compromise.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2018-13317 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2018-13317 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending unauthenticated GET requests to the /password.htm endpoint, which exposes plaintext admin credentials on vulnerable TOTOLINK A3002RU devices.