VYPR

T10 Firmware

by Totolink

CVEs (22)

  • CVE-2025-14964CriDec 19, 2025
    Totolink
    T10
    risk 0.64cvss 9.8epss 0.01

    A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to stack-based buffer overflow. The attack may be performed from remote.

  • CVE-2025-44655CriJul 21, 2025
    Totolink
    A7100RU
    risk 0.64cvss 9.8epss 0.00

    In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.

  • CVE-2024-8162CriAug 26, 2024
    Totolink
    T10 Firmware
    risk 0.64cvss 9.8epss 0.02

    A vulnerability classified as critical has been found in TOTOLINK T10 AC1200 4.1.8cu.5207. Affected is an unknown function of the file /squashfs-root/web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to hard-coded credentials. It is possible to…

  • CVE-2022-25137CriFeb 19, 2022
    Totolink
    T10
    risk 0.64cvss 9.8epss 0.02

    A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

  • CVE-2022-25136CriFeb 19, 2022
    TOTOLINK Technology
    T6
    risk 0.64cvss 9.8epss 0.02

    A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

  • CVE-2022-25132CriFeb 19, 2022
    TOTOLINK Technology
    T6
    risk 0.64cvss 9.8epss 0.03

    A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

  • CVE-2022-25131CriFeb 19, 2022
    Totolink
    T10
    risk 0.64cvss 9.8epss 0.02

    A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

  • CVE-2022-25130CriFeb 19, 2022
    Totolink
    T10
    risk 0.64cvss 9.8epss 0.02

    A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

  • CVE-2025-5905HigJun 10, 2025
    Totolink
    T10
    risk 0.58cvss 8.8epss 0.09

    A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been rated as critical. Affected by this issue is the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument Password leads to buffer…

  • CVE-2025-5904HigJun 10, 2025
    Totolink
    T10
    risk 0.58cvss 8.8epss 0.09

    A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument device_name leads to…

  • CVE-2025-5903HigJun 10, 2025
    Totolink
    T10
    risk 0.58cvss 8.8epss 0.09

    A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is…

  • CVE-2025-5902HigJun 9, 2025
    Totolink
    T10
    risk 0.58cvss 8.8epss 0.05

    A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument slaveIpList leads to buffer overflow. The…

  • CVE-2025-5901HigJun 9, 2025
    Totolink
    T10
    risk 0.58cvss 8.8epss 0.05

    A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument File leads to buffer…

  • CVE-2025-6138HigJun 16, 2025
    Totolink
    T10
    risk 0.57cvss 8.8epss 0.01

    A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ssid5g leads to buffer…

  • CVE-2025-6137HigJun 16, 2025
    Totolink
    T10
    risk 0.57cvss 8.8epss 0.01

    A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is…

  • CVE-2025-4496HigMay 10, 2025
    Totolink
    A950RG
    risk 0.57cvss 8.8epss 0.01

    A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument…

  • CVE-2024-8577HigSep 8, 2024
    Totolink
    AC1200 T8
    risk 0.57cvss 8.8epss 0.01

    A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to…

  • CVE-2024-8576HigSep 8, 2024
    Totolink
    AC1200 T8
    risk 0.57cvss 8.8epss 0.01

    A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been classified as critical. Affected is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow.…

  • CVE-2024-8573HigSep 8, 2024
    Totolink
    AC1200 T8
    risk 0.57cvss 8.8epss 0.01

    A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime/eTime leads to…

  • CVE-2025-9533HigAug 27, 2025
    Totolink
    T10
    risk 0.48cvss 7.3epss 0.09

    A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to improper authentication. The attack can be initiated remotely. The exploit…

Page 1 of 2