Vendor CVEs

Totolink

All CVEs

1,253 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2024-0298	Totolink N200RE	Hig	0.48	7.3	0.04	Jan 8, 2024	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the…
CVE-2024-0297	Totolink N200RE	Hig	0.48	7.3	0.04	Jan 8, 2024	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be…
CVE-2024-0296	Totolink N200RE	Hig	0.48	7.3	0.04	Jan 8, 2024	A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to os command injection. The attack can…
CVE-2024-0295	Totolink LR1200GB	Hig	0.48	7.3	0.04	Jan 8, 2024	A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the…
CVE-2024-0294	Totolink LR1200GB	Hig	0.48	7.3	0.04	Jan 8, 2024	A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection. The attack may be…
CVE-2026-7219	Totolink N300RT	Hig	0.47	7.2	0.01	Apr 28, 2026	A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the argument entry_name can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and…
CVE-2026-7218	Totolink N300RT	Hig	0.47	7.2	0.00	Apr 28, 2026	A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_valid of the file /boafrm/formWsc of the component libapmib.so. Performing a manipulation of the argument localPin results in buffer overflow. The attack is…
CVE-2026-5676	Totolink A8000R	Hig	0.47	7.3	0.00	Apr 6, 2026	A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is…
CVE-2026-4611	Totolink X6000R	Hig	0.47	7.2	0.03	Mar 23, 2026	A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched…
CVE-2025-8181	Totolink N600R	Hig	0.47	7.2	0.01	Jul 26, 2025	A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack…
CVE-2025-28028	Totolink A950RG	Hig	0.47	7.3	0.00	Apr 23, 2025	TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter.
CVE-2025-28025	Totolink A950RG	Hig	0.47	7.3	0.00	Apr 23, 2025	TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
CVE-2025-28022	Totolink A810R	Hig	0.47	7.3	0.00	Apr 23, 2025	TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2025-28021	Totolink A810R	Hig	0.47	7.3	0.00	Apr 23, 2025	TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters
CVE-2025-28020	Totolink A800r Firmware	Hig	0.47	7.3	0.00	Apr 23, 2025	TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2025-28019	Totolink A800r Firmware	Hig	0.47	7.3	0.00	Apr 23, 2025	TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component
CVE-2025-28018	Totolink A800r Firmware	Hig	0.47	7.3	0.00	Apr 23, 2025	TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
CVE-2025-28029	Totolink A950RG	Hig	0.47	7.3	0.00	Apr 22, 2025	TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi
CVE-2025-28027	Totolink A950RG	Hig	0.47	7.3	0.00	Apr 22, 2025	TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
CVE-2025-28026	Totolink A950RG	Hig	0.47	7.3	0.00	Apr 22, 2025	TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi.
CVE-2025-28033	Totolink A810R	Hig	0.47	7.3	0.00	Apr 22, 2025	TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerability in the…
CVE-2025-28032	Totolink A810R	Hig	0.47	7.3	0.00	Apr 22, 2025	TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function…
CVE-2024-34215	Totolink CP450	Hig	0.47	7.3	0.01	May 14, 2024	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function.
CVE-2024-34212	Totolink CP450	Hig	0.47	7.3	0.01	May 14, 2024	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the CloudACMunualUpdate function.
CVE-2024-34201	Totolink CP450	Hig	0.47	7.3	0.01	May 14, 2024	TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function.
CVE-2024-1004	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to…
CVE-2024-1003	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffer overflow. The…
CVE-2024-1002	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer overflow. The…
CVE-2024-1001	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cstecgi.cgi. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has…
CVE-2024-1000	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to stack-based buffer overflow. The attack may be…
CVE-2024-0999	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument eTime leads to stack-based buffer overflow. The…
CVE-2024-0998	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. It is possible to…
CVE-2024-0997	Totolink N200RE	Hig	0.47	7.2	0.01	Jan 29, 2024	A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. The attack may be…
CVE-2023-7222	Totolink X2000r Firmware	Hig	0.47	7.2	0.01	Jan 9, 2024	A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of the file /bin/boa of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer…
CVE-2023-7219	Totolink N350R	Hig	0.47	7.2	0.01	Jan 9, 2024	A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The…
CVE-2023-7218	Totolink N350R	Hig	0.47	7.2	0.01	Jan 8, 2024	A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the…
CVE-2022-38535	Totolink 720R	Hig	0.47	7.2	0.02	Sep 15, 2022	TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function.
CVE-2022-38534	Totolink 720R	Hig	0.47	7.2	0.02	Sep 15, 2022	TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.
CVE-2022-28935	Totolink A950RG	Hig	0.47	7.2	0.03	Jul 6, 2022	Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to contain a command…
CVE-2024-51228	Totolink A3002RU	Med	0.45	6.8	0.04	Nov 27, 2024	An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523…
CVE-2024-57025	Totolink X5000R	Med	0.44	6.8	0.01	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg.
CVE-2024-57024	Totolink X5000R	Med	0.44	6.8	0.02	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg.
CVE-2024-57023	Totolink X5000R	Med	0.44	6.8	0.01	Jan 15, 2025	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.
CVE-2024-42740	Totolink X5000R	Med	0.44	6.8	0.03	Aug 13, 2024	In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-41315	Totolink A6000R	Med	0.44	6.8	0.02	Jul 22, 2024	TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
CVE-2024-41314	Totolink A6000R	Med	0.44	6.8	0.02	Jul 22, 2024	TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
CVE-2024-32326	Totolink EX200	Med	0.44	6.8	0.01	Apr 18, 2024	TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderConfig function.
CVE-2025-60687	Totolink LR1200GB	Med	0.43	6.5	0.07	Nov 13, 2025	An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters…
CVE-2024-7464	Totolink Cp900 Firmware	Med	0.43	6.3	0.20	Aug 5, 2024	A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The manipulation of the argument telnet_enabled leads to command injection. The attack may be initiated…
CVE-2021-46006	Totolink A3100R	Med	0.43	6.5	0.05	Mar 30, 2022	In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.

CVE-2024-0298HigJan 8, 2024
Totolink
N200RE
risk 0.48cvss 7.3epss 0.04
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to launch the…
CVE-2024-0297HigJan 8, 2024
Totolink
N200RE
risk 0.48cvss 7.3epss 0.04
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to os command injection. The attack may be…
CVE-2024-0296HigJan 8, 2024
Totolink
N200RE
risk 0.48cvss 7.3epss 0.04
A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to os command injection. The attack can…
CVE-2024-0295HigJan 8, 2024
Totolink
LR1200GB
risk 0.48cvss 7.3epss 0.04
A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. This affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to os command injection. It is possible to initiate the…
CVE-2024-0294HigJan 8, 2024
Totolink
LR1200GB
risk 0.48cvss 7.3epss 0.04
A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected by this issue is the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to os command injection. The attack may be…
CVE-2026-7219HigApr 28, 2026
Totolink
N300RT
risk 0.47cvss 7.2epss 0.01
A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the argument entry_name can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and…
CVE-2026-7218HigApr 28, 2026
Totolink
N300RT
risk 0.47cvss 7.2epss 0.00
A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_valid of the file /boafrm/formWsc of the component libapmib.so. Performing a manipulation of the argument localPin results in buffer overflow. The attack is…
CVE-2026-5676HigApr 6, 2026
Totolink
A8000R
risk 0.47cvss 7.3epss 0.00
A vulnerability was identified in Totolink A8000R 5.9c.681_B20180413. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument langType leads to missing authentication. The attack can be launched remotely. The exploit is…
CVE-2026-4611HigMar 23, 2026
Totolink
X6000R
risk 0.47cvss 7.2epss 0.03
A flaw has been found in TOTOLINK X6000R 9.4.0cu.1360_B20241207/9.4.0cu.1498_B20250826. Affected by this issue is the function setLanCfg of the file /usr/sbin/shttpd. Executing a manipulation of the argument Hostname can lead to os command injection. The attack may be launched…
CVE-2025-8181HigJul 26, 2025
Totolink
N600R
risk 0.47cvss 7.2epss 0.01
A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack…
CVE-2025-28028HigApr 23, 2025
Totolink
A950RG
risk 0.47cvss 7.3epss 0.00
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter.
CVE-2025-28025HigApr 23, 2025
Totolink
A950RG
risk 0.47cvss 7.3epss 0.00
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
CVE-2025-28022HigApr 23, 2025
Totolink
A810R
risk 0.47cvss 7.3epss 0.00
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2025-28021HigApr 23, 2025
Totolink
A810R
risk 0.47cvss 7.3epss 0.00
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters
CVE-2025-28020HigApr 23, 2025
Totolink
A800r Firmware
risk 0.47cvss 7.3epss 0.00
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2025-28019HigApr 23, 2025
Totolink
A800r Firmware
risk 0.47cvss 7.3epss 0.00
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component
CVE-2025-28018HigApr 23, 2025
Totolink
A800r Firmware
risk 0.47cvss 7.3epss 0.00
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
CVE-2025-28029HigApr 22, 2025
Totolink
A950RG
risk 0.47cvss 7.3epss 0.00
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi
CVE-2025-28027HigApr 22, 2025
Totolink
A950RG
risk 0.47cvss 7.3epss 0.00
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
CVE-2025-28026HigApr 22, 2025
Totolink
A950RG
risk 0.47cvss 7.3epss 0.00
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi.
CVE-2025-28033HigApr 22, 2025
Totolink
A810R
risk 0.47cvss 7.3epss 0.00
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerability in the…
CVE-2025-28032HigApr 22, 2025
Totolink
A810R
risk 0.47cvss 7.3epss 0.00
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function…
CVE-2024-34215HigMay 14, 2024
Totolink
CP450
risk 0.47cvss 7.3epss 0.01
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function.
CVE-2024-34212HigMay 14, 2024
Totolink
CP450
risk 0.47cvss 7.3epss 0.01
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the CloudACMunualUpdate function.
CVE-2024-34201HigMay 14, 2024
Totolink
CP450
risk 0.47cvss 7.3epss 0.01
TOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a stack buffer overflow vulnerability in the getSaveConfig function.
CVE-2024-1004HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. It is possible to…
CVE-2024-1003HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffer overflow. The…
CVE-2024-1002HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer overflow. The…
CVE-2024-1001HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cstecgi.cgi. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has…
CVE-2024-1000HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to stack-based buffer overflow. The attack may be…
CVE-2024-0999HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument eTime leads to stack-based buffer overflow. The…
CVE-2024-0998HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. It is possible to…
CVE-2024-0997HigJan 29, 2024
Totolink
N200RE
risk 0.47cvss 7.2epss 0.01
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. The attack may be…
CVE-2023-7222HigJan 9, 2024
Totolink
X2000r Firmware
risk 0.47cvss 7.2epss 0.01
A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of the file /bin/boa of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer…
CVE-2023-7219HigJan 9, 2024
Totolink
N350R
risk 0.47cvss 7.2epss 0.01
A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. The…
CVE-2023-7218HigJan 8, 2024
Totolink
N350R
risk 0.47cvss 7.2epss 0.01
A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is possible to launch the…
CVE-2022-38535HigSep 15, 2022
Totolink
720R
risk 0.47cvss 7.2epss 0.02
TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function.
CVE-2022-38534HigSep 15, 2022
Totolink
720R
risk 0.47cvss 7.2epss 0.02
TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.
CVE-2022-28935HigJul 6, 2022
Totolink
A950RG
risk 0.47cvss 7.2epss 0.03
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to contain a command…
CVE-2024-51228MedNov 27, 2024
Totolink
A3002RU
risk 0.45cvss 6.8epss 0.04
An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523…
CVE-2024-57025MedJan 15, 2025
Totolink
X5000R
risk 0.44cvss 6.8epss 0.01
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setWiFiScheduleCfg.
CVE-2024-57024MedJan 15, 2025
Totolink
X5000R
risk 0.44cvss 6.8epss 0.02
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "eMinute" parameter in setWiFiScheduleCfg.
CVE-2024-57023MedJan 15, 2025
Totolink
X5000R
risk 0.44cvss 6.8epss 0.01
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setWiFiScheduleCfg.
CVE-2024-42740MedAug 13, 2024
Totolink
X5000R
risk 0.44cvss 6.8epss 0.03
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-41315MedJul 22, 2024
Totolink
A6000R
risk 0.44cvss 6.8epss 0.02
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
CVE-2024-41314MedJul 22, 2024
Totolink
A6000R
risk 0.44cvss 6.8epss 0.02
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
CVE-2024-32326MedApr 18, 2024
Totolink
EX200
risk 0.44cvss 6.8epss 0.01
TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderConfig function.
CVE-2025-60687MedNov 13, 2025
Totolink
LR1200GB
risk 0.43cvss 6.5epss 0.07
An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters…
CVE-2024-7464MedAug 5, 2024
Totolink
Cp900 Firmware
risk 0.43cvss 6.3epss 0.20
A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The manipulation of the argument telnet_enabled leads to command injection. The attack may be initiated…
CVE-2021-46006MedMar 30, 2022
Totolink
A3100R
risk 0.43cvss 6.5epss 0.05
In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.

Page 20 of 26