Totolink vulnerabilities

CVE-2026-31179 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31178 Critical · 9.8 CWE-78 Apr 23, 2026

OS Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31177 Critical · 9.8 CWE-78 Apr 23, 2026

OS Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31176 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun_user parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31175 Critical · 9.8 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31174 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31172 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31171 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the url parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31165 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31164 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31160 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-31159 Medium · 6.5 CWE-77 Apr 23, 2026

Command Injection in Totolink A3300r Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi.

CVE-2026-6195 Critical · 9.8 CWE-77 Apr 13, 2026

Totolink A7100RU command injection via admpass in setPasswordCfg

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-6194 High · 8.8 CWE-119 Apr 13, 2026

Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow

A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by this vulnerability is the function sub_410188 of the file /boafrm/formWlanSetup of the component HTTP Request Handler. This manipulation of the argument wan-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

CVE-2026-6168 High · 8.8 CWE-119 Apr 13, 2026

TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow

A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid5g causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVE-2026-6158 High · 7.3 CWE-77 Apr 13, 2026

Totolink N300RH upgrade.so setUpgradeUboot os command injection

A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVE-2026-6157 High · 8.8 CWE-119 Apr 13, 2026

Totolink A800R app.so setAppEasyWizardConfig buffer overflow

A vulnerability was detected in Totolink A800R 4.1.2cu.5137_B20200730. This impacts the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. The manipulation of the argument apcliSsid results in buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

CVE-2026-6156 Critical · 9.8 CWE-77 Apr 13, 2026

Totolink A7100RU OS Command Injection via setIpQosRules

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument Comment leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

CVE-2026-6155 Critical · 9.8 CWE-77 Apr 13, 2026

Totolink A7100RU OS Command Injection via setWanCfg pppoeServiceName

A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument pppoeServiceName can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-6154 Critical · 9.8 CWE-77 Apr 13, 2026

Totolink A7100RU OS Command Injection in setWizardCfg (CVE-2026-6154)

A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wizard results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-6140 Critical · 9.8 CWE-77 Apr 12, 2026

Totolink A7100RU OS Command Injection via UploadFirmwareFile FileName Parameter

A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument FileName results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be used.

CVE-2026-6139 Critical · 9.8 CWE-77 Apr 12, 2026

Totolink A7100RU OS Command Injection in UploadOpenVpnCert (CVE-2026-6139)

A vulnerability has been found in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function UploadOpenVpnCert of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument FileName leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-6138 Critical · 9.8 CWE-77 Apr 12, 2026

Totolink A7100RU OS Command Injection in setAccessDeviceCfg (CVE-2026-6138)

A flaw has been found in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setAccessDeviceCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mac causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2026-6132 Critical · 9.8 CWE-77 Apr 12, 2026

Totolink A7100RU setLedCfg OS Command Injection (CVE-2026-6132)

A vulnerability was determined in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setLedCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVE-2026-6131 Critical · 9.8 CWE-77 Apr 12, 2026

Totolink A7100RU OS Command Injection in setTracerouteCfg (CVE-2026-6131)

A vulnerability was found in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument command results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used.