In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.
The product does not adequately filter user-controlled input for special elements with control implications.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ex200_firmware | Totolink | 4.0.3c.7646_b20201211 (including) | 4.0.3c.7646_b20201211 (including) |