CVE Intelligence

Vulnerabilidades do Totolink A7000R

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Totolink A7000R: 5 registro(s), com versões afetadas e correções.

CVE-2026-6168 Alta · 8.8 CWE-119 13/04/2026
TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow
A flaw has been found in TOTOLINK A7000R up to 9.1.0u.6115. The affected element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid5g causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.
CVE-2026-1623 Média · 6.3 CWE-74 29/01/2026
Totolink A7000R cstecgi.cgi setUpgradeFW command injection
A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-1601 Média · 6.3 CWE-74 29/01/2026
Totolink A7000R cstecgi.cgi setUploadUserData command injection
A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument FileName can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-1548 Alta · 8.8 CWE-77 28/01/2026
Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection
A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url causes command injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVE-2026-1547 Crítica · 9.8 CWE-77 28/01/2026
Injeção de comando no firmware Totolink A7000R em cstecgi.cgi (CVE-2026-1547)
Foi detectada uma vulnerabilidade no Totolink A7000R 4.1cu.4154. Isso afeta a função setUnloadUserData do arquivo /cgi-bin/cstecgi.cgi. A manipulação do argumento plugin_name resulta em injeção de comando. É possível lançar o ataque remotamente. O exploit agora está público e pode ser usado.