Totolink vulnerabilities
Published CVEs affecting Totolink products: 302 record(s), with severity, exploitation and fixes.
A8000RU 50A7100RU 40A3300r Firmware 37Totolink 30A3300R 15Lr350 Firmware 14A3002MU 14A800R 10N300RH 10A7000r Firmware 10CA750-PoE 9NR1800X 9WA300 8LR350 7Nr1800x Firmware 7A950rg Firmware 6N600r Firmware 5X5000r Firmware 5X6000R 5A7000R 5A720r Firmware 4Lr1200gb Firmware 4N600R 4X5000R 4X6000r Firmware 4A3600r Firmware 3A3002ru Firmware 3CP450 3EX1200L 3N300RT 3Wa300 Firmware 3EX200 2N200re Firmware 2A3600R 2N300rh Firmware 2Wa1200-poe Firmware 1A3700r Firmware 1A720R 1N150RT 1CS185R T10 1
CVE-2026-31167
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31166
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31163
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31162
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31181
Critical · 9.8
CWE-78 Apr 23, 2026
OS Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31179
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31178
Critical · 9.8
CWE-78 Apr 23, 2026
OS Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31177
Critical · 9.8
CWE-78 Apr 23, 2026
OS Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31176
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun_user parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31175
Critical · 9.8
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31174
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31172
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31171
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the url parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31165
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31164
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31160
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31159
Medium · 6.5
CWE-77 Apr 23, 2026
Command Injection in Totolink A3300r Firmware
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-6195
Critical · 9.8
CWE-77 Apr 13, 2026
Totolink A7100RU command injection via admpass in setPasswordCfg
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-6194
High · 8.8
CWE-119 Apr 13, 2026
Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow
A weakness has been identified in Totolink A3002MU B20211125.1046. Affected by this vulnerability is the function sub_410188 of the file /boafrm/formWlanSetup of the component HTTP Request Handler. This manipulation of the argument wan-url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVE-2026-6168
High · 8.8
CWE-119 Apr 13, 2026
TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow
A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid5g causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2026-6158
High · 7.3
CWE-77 Apr 13, 2026
Totolink N300RH upgrade.so setUpgradeUboot os command injection
A flaw has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setUpgradeUboot of the file upgrade.so. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
CVE-2026-6157
High · 8.8
CWE-119 Apr 13, 2026
Totolink A800R app.so setAppEasyWizardConfig buffer overflow
A vulnerability was detected in Totolink A800R 4.1.2cu.5137_B20200730. This impacts the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. The manipulation of the argument apcliSsid results in buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.
CVE-2026-6156
Critical · 9.8
CWE-77 Apr 13, 2026
Totolink A7100RU OS Command Injection via setIpQosRules
A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument Comment leads to os command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-6155
Critical · 9.8
CWE-77 Apr 13, 2026
Totolink A7100RU OS Command Injection via setWanCfg pppoeServiceName
A weakness has been identified in Totolink A7100RU 7.4cu.2313. The impacted element is the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument pppoeServiceName can lead to os command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-6154
Critical · 9.8
CWE-77 Apr 13, 2026
Totolink A7100RU OS Command Injection in setWizardCfg (CVE-2026-6154)
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. The affected element is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument wizard results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks.