Vendor CVEs
Totolink
All CVEs
1,201 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-48113 | 0.00 | — | 0.01 | Feb 2, 2023 | A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials. | |||
| CVE-2022-48067 | 0.00 | — | 0.00 | Jan 27, 2023 | An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack. | |||
| CVE-2022-48066 | 0.00 | — | 0.01 | Jan 27, 2023 | An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie. | |||
| CVE-2022-44253 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function. | |||
| CVE-2022-44260 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function. | |||
| CVE-2022-44257 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function. | |||
| CVE-2022-44258 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function. | |||
| CVE-2022-44259 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function. | |||
| CVE-2022-44254 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function. | |||
| CVE-2022-44255 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data. | |||
| CVE-2022-44256 | 0.00 | — | 0.02 | Nov 23, 2022 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function. | |||
| CVE-2022-41527 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function. | |||
| CVE-2022-41517 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function | |||
| CVE-2022-41523 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function. | |||
| CVE-2022-41520 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function. | |||
| CVE-2022-41526 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function. | |||
| CVE-2022-41521 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules function. | |||
| CVE-2022-41524 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRules function. | |||
| CVE-2022-41528 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. | |||
| CVE-2022-41522 | 0.00 | — | 0.01 | Oct 6, 2022 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function. | |||
| CVE-2022-40475 | 0.00 | — | 0.04 | Sep 29, 2022 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi. | |||
| CVE-2022-38535 | 0.00 | — | 0.02 | Sep 15, 2022 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function. | |||
| CVE-2022-38534 | 0.00 | — | 0.02 | Sep 15, 2022 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function. | |||
| CVE-2022-40112 | 0.00 | — | 0.01 | Sep 6, 2022 | TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable Buffer Overflow via the hostname parameter in binary /bin/boa. | |||
| CVE-2022-40111 | 0.00 | — | 0.01 | Sep 6, 2022 | In TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 in the shadow.sample file, root is hardcoded in the firmware. | |||
| CVE-2022-40110 | 0.00 | — | 0.01 | Sep 6, 2022 | TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa. | |||
| CVE-2022-40109 | 0.00 | — | 0.01 | Sep 6, 2022 | TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Insecure Permissions via binary /bin/boa. | |||
| CVE-2022-37842 | 0.00 | — | 0.01 | Sep 6, 2022 | In TOTOLINK A860R V4.1.2cu.5182_B20201027, the parameters in infostat.cgi are not filtered, causing a buffer overflow vulnerability. | |||
| CVE-2022-37840 | 0.00 | — | 0.01 | Sep 6, 2022 | In TOTOLINK A860R V4.1.2cu.5182_B20201027, the main function in downloadfile.cgi has a buffer overflow vulnerability. | |||
| CVE-2022-37841 | 0.00 | — | 0.01 | Sep 6, 2022 | In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample. | |||
| CVE-2022-37839 | 0.00 | — | 0.01 | Sep 6, 2022 | TOTOLINK A860R V4.1.2cu.5182_B20201027 is vulnerable to Buffer Overflow via Cstecgi.cgi. | |||
| CVE-2022-37843 | 0.00 | — | 0.01 | Sep 6, 2022 | In TOTOLINK A860R V4.1.2cu.5182_B20201027 in cstecgi.cgi, the acquired parameters are directly put into the system for execution without filtering, resulting in a command injection vulnerability. | |||
| CVE-2022-32993 | 0.00 | — | 0.01 | Aug 29, 2022 | TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh. | |||
| CVE-2022-38511 | 0.00 | — | 0.01 | Aug 28, 2022 | TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi. | |||
| CVE-2022-36615 | 0.00 | — | 0.00 | Aug 28, 2022 | TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample. | |||
| CVE-2022-36616 | 0.00 | — | 0.00 | Aug 28, 2022 | TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample. | |||
| CVE-2022-36614 | 0.00 | — | 0.00 | Aug 28, 2022 | TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample. | |||
| CVE-2022-36612 | 0.00 | — | 0.00 | Aug 28, 2022 | TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample. | |||
| CVE-2022-36613 | 0.00 | — | 0.00 | Aug 28, 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample. | |||
| CVE-2022-36611 | 0.00 | — | 0.00 | Aug 28, 2022 | TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample. | |||
| CVE-2022-36610 | 0.00 | — | 0.00 | Aug 28, 2022 | TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample. | |||
| CVE-2022-36455 | 0.00 | — | 0.01 | Aug 25, 2022 | TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi. | |||
| CVE-2022-37084 | 0.00 | — | 0.00 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the sPort parameter at the addEffect function. | |||
| CVE-2022-37083 | 0.00 | — | 0.01 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg. | |||
| CVE-2022-37082 | 0.00 | — | 0.01 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the function NTPSyncWithHost. | |||
| CVE-2022-37080 | 0.00 | — | 0.00 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the command parameter at setting/setTracerouteCfg. | |||
| CVE-2022-37081 | 0.00 | — | 0.01 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg. | |||
| CVE-2022-37079 | 0.00 | — | 0.01 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg. | |||
| CVE-2022-37078 | 0.00 | — | 0.01 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the lang parameter at /setting/setLanguageCfg. | |||
| CVE-2022-37077 | 0.00 | — | 0.00 | Aug 25, 2022 | TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the pppoeUser parameter. |
- CVE-2022-48113Feb 2, 2023risk 0.00cvss —epss 0.01
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
- CVE-2022-48067Jan 27, 2023risk 0.00cvss —epss 0.00
An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
- CVE-2022-48066Jan 27, 2023risk 0.00cvss —epss 0.01
An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.
- CVE-2022-44253Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.
- CVE-2022-44260Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function.
- CVE-2022-44257Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.
- CVE-2022-44258Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function.
- CVE-2022-44259Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.
- CVE-2022-44254Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function.
- CVE-2022-44255Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
- CVE-2022-44256Nov 23, 2022risk 0.00cvss —epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.
- CVE-2022-41527Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function.
- CVE-2022-41517Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function
- CVE-2022-41523Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function.
- CVE-2022-41520Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function.
- CVE-2022-41526Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function.
- CVE-2022-41521Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules function.
- CVE-2022-41524Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRules function.
- CVE-2022-41528Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
- CVE-2022-41522Oct 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function.
- CVE-2022-40475Sep 29, 2022risk 0.00cvss —epss 0.04
TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.
- CVE-2022-38535Sep 15, 2022risk 0.00cvss —epss 0.02
TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function.
- CVE-2022-38534Sep 15, 2022risk 0.00cvss —epss 0.02
TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.
- CVE-2022-40112Sep 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable Buffer Overflow via the hostname parameter in binary /bin/boa.
- CVE-2022-40111Sep 6, 2022risk 0.00cvss —epss 0.01
In TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 in the shadow.sample file, root is hardcoded in the firmware.
- CVE-2022-40110Sep 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa.
- CVE-2022-40109Sep 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Insecure Permissions via binary /bin/boa.
- CVE-2022-37842Sep 6, 2022risk 0.00cvss —epss 0.01
In TOTOLINK A860R V4.1.2cu.5182_B20201027, the parameters in infostat.cgi are not filtered, causing a buffer overflow vulnerability.
- CVE-2022-37840Sep 6, 2022risk 0.00cvss —epss 0.01
In TOTOLINK A860R V4.1.2cu.5182_B20201027, the main function in downloadfile.cgi has a buffer overflow vulnerability.
- CVE-2022-37841Sep 6, 2022risk 0.00cvss —epss 0.01
In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample.
- CVE-2022-37839Sep 6, 2022risk 0.00cvss —epss 0.01
TOTOLINK A860R V4.1.2cu.5182_B20201027 is vulnerable to Buffer Overflow via Cstecgi.cgi.
- CVE-2022-37843Sep 6, 2022risk 0.00cvss —epss 0.01
In TOTOLINK A860R V4.1.2cu.5182_B20201027 in cstecgi.cgi, the acquired parameters are directly put into the system for execution without filtering, resulting in a command injection vulnerability.
- CVE-2022-32993Aug 29, 2022risk 0.00cvss —epss 0.01
TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.
- CVE-2022-38511Aug 28, 2022risk 0.00cvss —epss 0.01
TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downloadFile.cgi.
- CVE-2022-36615Aug 28, 2022risk 0.00cvss —epss 0.00
TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36616Aug 28, 2022risk 0.00cvss —epss 0.00
TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36614Aug 28, 2022risk 0.00cvss —epss 0.00
TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36612Aug 28, 2022risk 0.00cvss —epss 0.00
TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36613Aug 28, 2022risk 0.00cvss —epss 0.00
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36611Aug 28, 2022risk 0.00cvss —epss 0.00
TOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36610Aug 28, 2022risk 0.00cvss —epss 0.00
TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2022-36455Aug 25, 2022risk 0.00cvss —epss 0.01
TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi.
- CVE-2022-37084Aug 25, 2022risk 0.00cvss —epss 0.00
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the sPort parameter at the addEffect function.
- CVE-2022-37083Aug 25, 2022risk 0.00cvss —epss 0.01
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg.
- CVE-2022-37082Aug 25, 2022risk 0.00cvss —epss 0.01
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the function NTPSyncWithHost.
- CVE-2022-37080Aug 25, 2022risk 0.00cvss —epss 0.00
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the command parameter at setting/setTracerouteCfg.
- CVE-2022-37081Aug 25, 2022risk 0.00cvss —epss 0.01
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg.
- CVE-2022-37079Aug 25, 2022risk 0.00cvss —epss 0.01
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
- CVE-2022-37078Aug 25, 2022risk 0.00cvss —epss 0.01
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the lang parameter at /setting/setLanguageCfg.
- CVE-2022-37077Aug 25, 2022risk 0.00cvss —epss 0.00
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the pppoeUser parameter.
Page 22 of 25