Totolink A7000r Firmware vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Totolink A7000r Firmware: 10 record(s), with affected versions and fixes.cpe:2.3:o:totolink:a7000r_firmware
CVE-2026-1623
Medium · 6.3
CWE-74 Jan 29, 2026
Totolink A7000R cstecgi.cgi setUpgradeFW command injection
A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-1601
Medium · 6.3
CWE-74 Jan 29, 2026
Totolink A7000R cstecgi.cgi setUploadUserData command injection
A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument FileName can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-1548
High · 8.8
CWE-77 Jan 28, 2026
Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection
A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url causes command injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVE-2026-1547
Critical · 9.8
CWE-77 Jan 28, 2026
Totolink A7000R Firmware Command Injection in cstecgi.cgi (CVE-2026-1547)
A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVE-2025-63154
High · 7.5
CWE-121 Nov 10, 2025
Stack-based Buffer Overflow in Totolink A7000r Firmware
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2025-63153
High · 7.5
CWE-121 Nov 10, 2025
Stack-based Buffer Overflow in Totolink A7000r Firmware
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63459
High · 7.5
CWE-121 Oct 31, 2025
Stack-based Buffer Overflow in Totolink A7000r Firmware
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63462
High · 7.5
CWE-121 Oct 31, 2025
Stack-based Buffer Overflow in Totolink A7000r Firmware
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63461
High · 7.5
CWE-121 Oct 31, 2025
Stack-based Buffer Overflow in Totolink A7000r Firmware
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-63460
High · 7.5
CWE-121 Oct 31, 2025
Stack-based Buffer Overflow in Totolink A7000r Firmware
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.