CVE-2022-46025

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, such as Wi-Fi SSID and Wi-Fi password, without logging into the management page.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
totolink	n200re_v5_firmware	9.3.5u.6255_b20211224

References

https://pastebin.com/aan5jT40Patch, Third Party Advisory
https://pastebin.com/aan5jT40Patch, Third Party Advisory

Timeline

Published: Jan 10, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-46036.5A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the compo CVE-2022-46048.8A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the functio CVE-2022-460474.9AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.CVE-2022-46055.4Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-460517.2The approve parameter from the AeroCMS-v0.0.1 CMS system is vulnerable to SQL injection attacks.CVE-2022-460584.8AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to CVE-2022-460596.5AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-46069.8PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.CVE-2022-460616.1AeroCMS v0.0.1 is vulnerable to ClickJacking.CVE-2022-460624.5Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2022-46079.8A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some CVE-2022-460707.5GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path.