TOTOLINK T10 Hard-Coded Password Vulnerability in Shadow Sample File

A vulnerability exists in the TOTOLINK T10 router running firmware version 4.1.8cu.5207. The issue arises from an unknown functionality in the file /etc/shadow.sample, where a hard-coded password is utilized. This vulnerability can only be exploited within the local network, and requires additional authentication. The exploitation is considered difficult, but a public proof-of-concept exploit is available.

Impact

The vulnerability introduces a hard-coded password, which can be exploited for unauthorized access or actions, potentially leading to a compromise of the device's functionality or security.