T6 Firmware

CVEs (39)

• CVE-2022-25084CriFeb 24, 2022
  Totolink

  T6
  risk 0.66cvss 9.8epss 0.25

  TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

• CVE-2022-38828CriSep 16, 2022
  Totolink

  T6
  risk 0.65cvss 9.8epss 0.19

  TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi

• CVE-2022-38827CriSep 16, 2022
  Totolink

  T6
  risk 0.65cvss 9.8epss 0.12

  TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi

• CVE-2023-7221CriJan 9, 2024
  Totolink

  T6
  risk 0.64cvss 9.8epss 0.02

  A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer…

• CVE-2022-38826CriSep 16, 2022
  Totolink

  T6
  risk 0.64cvss 9.8epss 0.01

  In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.

• CVE-2022-38823CriSep 16, 2022
  Totolink

  T6
  risk 0.64cvss 9.8epss 0.01

  In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.

• CVE-2022-25137CriFeb 19, 2022
  Totolink

  T10
  risk 0.64cvss 9.8epss 0.02

  A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2022-25136CriFeb 19, 2022
  TOTOLINK Technology

  T6
  risk 0.64cvss 9.8epss 0.02

  A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2022-25135CriFeb 19, 2022
  TOTOLINK Technology

  T6
  risk 0.64cvss 9.8epss 0.03

  A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2022-25134CriFeb 19, 2022
  TOTOLINK Technology

  T6
  risk 0.64cvss 9.8epss 0.03

  A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2022-25133CriFeb 19, 2022
  Totolink

  T6
  risk 0.64cvss 9.8epss 0.03

  A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2022-25132CriFeb 19, 2022
  TOTOLINK Technology

  T6
  risk 0.64cvss 9.8epss 0.03

  A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2022-25131CriFeb 19, 2022
  Totolink

  T10
  risk 0.64cvss 9.8epss 0.02

  A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2022-25130CriFeb 19, 2022
  Totolink

  T10
  risk 0.64cvss 9.8epss 0.02

  A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

• CVE-2025-8170HigJul 25, 2025
  EKEN

  T6
  risk 0.57cvss 8.8epss 0.01

  A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT Packet Handler. The manipulation of the argument serverIp leads to buffer overflow.…

• CVE-2025-7913HigJul 21, 2025
  EKEN

  T6
  risk 0.57cvss 8.8epss 0.01

  A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the argument serverIp leads to buffer overflow. It is possible to launch the attack…

• CVE-2025-7912HigJul 20, 2025
  Totolink

  T6
  risk 0.57cvss 8.8epss 0.01

  A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated…

• CVE-2025-7837HigJul 19, 2025
  EKEN

  T6
  risk 0.57cvss 8.8epss 0.01

  A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the component MQTT Service. The manipulation of the argument dest leads to buffer overflow. The attack may be launched remotely.…

• CVE-2025-7758HigJul 17, 2025
  Totolink

  T6
  risk 0.57cvss 8.8epss 0.01

  A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip…

• CVE-2025-7460HigJul 11, 2025
  Totolink

  T6
  risk 0.57cvss 8.8epss 0.01

  A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads…