Vendor CVEs

Totolink

All CVEs

1,253 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-46563	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.
CVE-2023-46562	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.
CVE-2023-46560	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.
CVE-2023-46559	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr.
CVE-2023-46558	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
CVE-2023-46557	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN.
CVE-2023-46556	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter.
CVE-2023-46555	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw.
CVE-2023-46554	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel.
CVE-2023-46553	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl.
CVE-2023-46552	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP.
CVE-2023-46551	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
CVE-2023-46550	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
CVE-2023-46549	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg.
CVE-2023-46548	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect.
CVE-2023-46547	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog.
CVE-2023-46546	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats.
CVE-2023-46545	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWsc.
CVE-2023-46544	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWirelessTbl.
CVE-2023-46543	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey.
CVE-2023-46542	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig.
CVE-2023-46541	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpv6Setup.
CVE-2023-46540	Totolink X2000r Firmware	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp.
CVE-2023-45984	Totolink X5000R	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
CVE-2023-36955	Totolink CP300	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-36954	Totolink CP300	Cri	0.64	9.8	0.02	Oct 16, 2023	TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36953	Totolink CP300	Cri	0.64	9.8	0.02	Oct 16, 2023	TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36950	Totolink X5000R	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-36952	Totolink CP300	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.
CVE-2023-36947	Totolink X5000R	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-36340	Totolink NR1800X	Cri	0.64	9.8	0.01	Oct 16, 2023	TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-43141	Totolink A3700R	Cri	0.64	9.8	0.01	Sep 25, 2023	TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
CVE-2023-39618	Totolink X5000R	Cri	0.64	9.8	0.01	Aug 21, 2023	TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
CVE-2023-39617	Totolink X5000R	Cri	0.64	9.8	0.01	Aug 21, 2023	TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVE-2023-40042	Totolink T10	Cri	0.64	9.8	0.02	Aug 8, 2023	TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.
CVE-2023-40041	Totolink T10	Cri	0.64	9.8	0.01	Aug 8, 2023	TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.
CVE-2023-37173	Totolink A3300R	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVE-2023-37172	Totolink A3300R	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVE-2023-37171	Totolink A3300R	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVE-2023-37170	Totolink A3300R	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVE-2023-37149	Totolink LR350	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
CVE-2023-37148	Totolink LR350	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.
CVE-2023-37146	Totolink LR350	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
CVE-2023-37145	Totolink LR350	Cri	0.64	9.8	0.02	Jul 7, 2023	TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
CVE-2023-33556	Totolink A7100RU	Cri	0.64	9.8	0.02	Jun 7, 2023	TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg.
CVE-2023-31569	Totolink X5000R	Cri	0.64	9.8	0.03	Jun 6, 2023	TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
CVE-2023-33487	Totolink X5000R	Cri	0.64	9.8	0.01	May 31, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter.
CVE-2023-33486	Totolink X5000R	Cri	0.64	9.8	0.01	May 31, 2023	TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter.
CVE-2023-31729	Totolink A3300R	Cri	0.64	9.8	0.01	May 18, 2023	TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
CVE-2023-31856	Totolink CP300	Cri	0.64	9.8	0.03	May 16, 2023	A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.

CVE-2023-46563CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.
CVE-2023-46562CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.
CVE-2023-46560CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.
CVE-2023-46559CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr.
CVE-2023-46558CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
CVE-2023-46557CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN.
CVE-2023-46556CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter.
CVE-2023-46555CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw.
CVE-2023-46554CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel.
CVE-2023-46553CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl.
CVE-2023-46552CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP.
CVE-2023-46551CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
CVE-2023-46550CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
CVE-2023-46549CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg.
CVE-2023-46548CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect.
CVE-2023-46547CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog.
CVE-2023-46546CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats.
CVE-2023-46545CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWsc.
CVE-2023-46544CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWirelessTbl.
CVE-2023-46543CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey.
CVE-2023-46542CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig.
CVE-2023-46541CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpv6Setup.
CVE-2023-46540CriOct 25, 2023
Totolink
X2000r Firmware
risk 0.64cvss 9.8epss 0.01
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp.
CVE-2023-45984CriOct 16, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
CVE-2023-36955CriOct 16, 2023
Totolink
CP300
risk 0.64cvss 9.8epss 0.01
TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-36954CriOct 16, 2023
Totolink
CP300
risk 0.64cvss 9.8epss 0.02
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36953CriOct 16, 2023
Totolink
CP300
risk 0.64cvss 9.8epss 0.02
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36950CriOct 16, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-36952CriOct 16, 2023
Totolink
CP300
risk 0.64cvss 9.8epss 0.01
TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.
CVE-2023-36947CriOct 16, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-36340CriOct 16, 2023
Totolink
NR1800X
risk 0.64cvss 9.8epss 0.01
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
CVE-2023-43141CriSep 25, 2023
Totolink
A3700R
risk 0.64cvss 9.8epss 0.01
TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
CVE-2023-39618CriAug 21, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
CVE-2023-39617CriAug 21, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVE-2023-40042CriAug 8, 2023
Totolink
T10
risk 0.64cvss 9.8epss 0.02
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cste_modules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code.
CVE-2023-40041CriAug 8, 2023
Totolink
T10
risk 0.64cvss 9.8epss 0.01
TOTOLINK T10_v2 5.9c.5061_B20200511 has a stack-based buffer overflow in setWiFiWpsConfig in /lib/cste_modules/wps.so. Attackers can send crafted data in an MQTT packet, via the pin parameter, to control the return address and execute code.
CVE-2023-37173CriJul 7, 2023
Totolink
A3300R
risk 0.64cvss 9.8epss 0.02
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVE-2023-37172CriJul 7, 2023
Totolink
A3300R
risk 0.64cvss 9.8epss 0.02
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVE-2023-37171CriJul 7, 2023
Totolink
A3300R
risk 0.64cvss 9.8epss 0.02
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVE-2023-37170CriJul 7, 2023
Totolink
A3300R
risk 0.64cvss 9.8epss 0.02
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVE-2023-37149CriJul 7, 2023
Totolink
LR350
risk 0.64cvss 9.8epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
CVE-2023-37148CriJul 7, 2023
Totolink
LR350
risk 0.64cvss 9.8epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.
CVE-2023-37146CriJul 7, 2023
Totolink
LR350
risk 0.64cvss 9.8epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
CVE-2023-37145CriJul 7, 2023
Totolink
LR350
risk 0.64cvss 9.8epss 0.02
TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
CVE-2023-33556CriJun 7, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg.
CVE-2023-31569CriJun 6, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.03
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
CVE-2023-33487CriMay 31, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter.
CVE-2023-33486CriMay 31, 2023
Totolink
X5000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter.
CVE-2023-31729CriMay 18, 2023
Totolink
A3300R
risk 0.64cvss 9.8epss 0.01
TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
CVE-2023-31856CriMay 16, 2023
Totolink
CP300
risk 0.64cvss 9.8epss 0.03
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.

Page 7 of 26