Vendor CVEs

Totolink

All CVEs

1,253 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-30054	Totolink A7100RU	Cri	0.64	9.8	0.02	May 5, 2023	TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVE-2023-30053	Totolink A7100RU	Cri	0.64	9.8	0.02	May 5, 2023	TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
CVE-2023-29803	Totolink X18	Cri	0.64	9.8	0.02	Apr 14, 2023	TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.
CVE-2023-29802	Totolink X18	Cri	0.64	9.8	0.02	Apr 14, 2023	TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVE-2023-29801	Totolink X18	Cri	0.64	9.8	0.02	Apr 14, 2023	TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.
CVE-2023-29800	Totolink X18	Cri	0.64	9.8	0.02	Apr 14, 2023	TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
CVE-2023-29799	Totolink X18	Cri	0.64	9.8	0.02	Apr 14, 2023	TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
CVE-2023-29798	Totolink X18	Cri	0.64	9.8	0.02	Apr 14, 2023	TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVE-2023-26978	Totolink A7100RU	Cri	0.64	9.8	0.02	Apr 7, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
CVE-2023-26848	Totolink A7100RU	Cri	0.64	9.8	0.02	Apr 7, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
CVE-2023-27232	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 28, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.
CVE-2023-27231	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 28, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg.
CVE-2023-27229	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 28, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg.
CVE-2022-28495	Totolink CPE CP900	Cri	0.64	9.8	0.02	Mar 24, 2023	TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-28496	Totolink CPE CP900	Cri	0.64	9.8	0.01	Mar 23, 2023	TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-28497	Totolink CPE CP900	Cri	0.64	9.8	0.01	Mar 23, 2023	TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2023-27135	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 23, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg.
CVE-2022-28493	Totolink Cp900 Firmware	Cri	0.64	9.8	0.01	Mar 23, 2023	A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,
CVE-2022-28491	Totolink CPE CP900	Cri	0.64	9.8	0.05	Mar 23, 2023	TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-28492	TOTOLINK Technology CPE	Cri	0.64	9.8	0.01	Mar 23, 2023	TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.
CVE-2022-28494	Totolink CPE CP900	Cri	0.64	9.8	0.03	Mar 23, 2023	TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2023-25395	Totolink A7100RU	Cri	0.64	9.8	0.02	Mar 8, 2023	TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
CVE-2023-24184	Totolink A7100RU	Cri	0.64	9.8	0.01	Feb 21, 2023	TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.
CVE-2023-23064	Totolink A720R	Cri	0.64	9.8	0.01	Feb 17, 2023	TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.
CVE-2023-24238	Totolink A7100RU	Cri	0.64	9.8	0.02	Feb 16, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
CVE-2023-24236	Totolink A7100RU	Cri	0.64	9.8	0.02	Feb 16, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
CVE-2023-24161	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 14, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
CVE-2023-24160	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 14, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVE-2023-24159	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 14, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.
CVE-2023-24276	Totolink A7100RU	Cri	0.64	9.8	0.02	Feb 6, 2023	TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
CVE-2023-24157	Totolink T8	Cri	0.64	9.8	0.02	Feb 3, 2023	A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24156	Totolink T8	Cri	0.64	9.8	0.02	Feb 3, 2023	A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24155	Totolink T8	Cri	0.64	9.8	0.01	Feb 3, 2023	TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.
CVE-2023-24154	Totolink T8	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.
CVE-2023-24153	Totolink T8	Cri	0.64	9.8	0.02	Feb 3, 2023	A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24152	Totolink T8	Cri	0.64	9.8	0.02	Feb 3, 2023	A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24151	Totolink T8	Cri	0.64	9.8	0.02	Feb 3, 2023	A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24150	Totolink T8	Cri	0.64	9.8	0.02	Feb 3, 2023	A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24149	Totolink CA300-PoE	Cri	0.64	9.8	0.01	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.
CVE-2023-24148	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
CVE-2023-24146	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function.
CVE-2023-24145	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
CVE-2023-24144	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.
CVE-2023-24143	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.
CVE-2023-24142	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.
CVE-2023-24141	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.
CVE-2023-24140	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.
CVE-2023-24139	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.
CVE-2023-24138	Totolink CA300-PoE	Cri	0.64	9.8	0.02	Feb 3, 2023	TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.
CVE-2022-48113	Totolink N200RE	Cri	0.64	9.8	0.01	Feb 2, 2023	A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.

CVE-2023-30054CriMay 5, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVE-2023-30053CriMay 5, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
CVE-2023-29803CriApr 14, 2023
Totolink
X18
risk 0.64cvss 9.8epss 0.02
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.
CVE-2023-29802CriApr 14, 2023
Totolink
X18
risk 0.64cvss 9.8epss 0.02
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVE-2023-29801CriApr 14, 2023
Totolink
X18
risk 0.64cvss 9.8epss 0.02
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.
CVE-2023-29800CriApr 14, 2023
Totolink
X18
risk 0.64cvss 9.8epss 0.02
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
CVE-2023-29799CriApr 14, 2023
Totolink
X18
risk 0.64cvss 9.8epss 0.02
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
CVE-2023-29798CriApr 14, 2023
Totolink
X18
risk 0.64cvss 9.8epss 0.02
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVE-2023-26978CriApr 7, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
CVE-2023-26848CriApr 7, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
CVE-2023-27232CriMar 28, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.
CVE-2023-27231CriMar 28, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg.
CVE-2023-27229CriMar 28, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWanIeCfg.
CVE-2022-28495CriMar 24, 2023
Totolink
CPE CP900
risk 0.64cvss 9.8epss 0.02
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-28496CriMar 23, 2023
Totolink
CPE CP900
risk 0.64cvss 9.8epss 0.01
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-28497CriMar 23, 2023
Totolink
CPE CP900
risk 0.64cvss 9.8epss 0.01
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2023-27135CriMar 23, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/setWanIeCfg.
CVE-2022-28493CriMar 23, 2023
Totolink
Cp900 Firmware
risk 0.64cvss 9.8epss 0.01
A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,
CVE-2022-28491CriMar 23, 2023
Totolink
CPE CP900
risk 0.64cvss 9.8epss 0.05
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2022-28492CriMar 23, 2023
TOTOLINK Technology
CPE
risk 0.64cvss 9.8epss 0.01
TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.
CVE-2022-28494CriMar 23, 2023
Totolink
CPE CP900
risk 0.64cvss 9.8epss 0.03
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2023-25395CriMar 8, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
CVE-2023-24184CriFeb 21, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.01
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.
CVE-2023-23064CriFeb 17, 2023
Totolink
A720R
risk 0.64cvss 9.8epss 0.01
TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.
CVE-2023-24238CriFeb 16, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
CVE-2023-24236CriFeb 16, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
CVE-2023-24161CriFeb 14, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
CVE-2023-24160CriFeb 14, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVE-2023-24159CriFeb 14, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.
CVE-2023-24276CriFeb 6, 2023
Totolink
A7100RU
risk 0.64cvss 9.8epss 0.02
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
CVE-2023-24157CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.02
A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24156CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.02
A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24155CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.01
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.
CVE-2023-24154CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.02
TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.
CVE-2023-24153CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.02
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24152CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.02
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24151CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.02
A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24150CriFeb 3, 2023
Totolink
T8
risk 0.64cvss 9.8epss 0.02
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24149CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.01
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.
CVE-2023-24148CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
CVE-2023-24146CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function.
CVE-2023-24145CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
CVE-2023-24144CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.
CVE-2023-24143CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.
CVE-2023-24142CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.
CVE-2023-24141CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.
CVE-2023-24140CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.
CVE-2023-24139CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.
CVE-2023-24138CriFeb 3, 2023
Totolink
CA300-PoE
risk 0.64cvss 9.8epss 0.02
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.
CVE-2022-48113CriFeb 2, 2023
Totolink
N200RE
risk 0.64cvss 9.8epss 0.01
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.

Page 8 of 26