Vulnerabilidades de Totolink

CVE-2026-105484 Crítica · 10.0 CWE-77 05/10/2026

TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.

CVE-2026-105286 Média · 6.3 CWE-22 05/10/2026

Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit is now public and may be used.

CVE-2026-105285 Crítica · 10.0 CWE-119 05/10/2026

Totolink A3002MU QoS Rule formIpQoS stack-based overflow

A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS of the component QoS Rule Handler. The manipulation of the argument addQos/comment/entry_name leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

CVE-2026-105284 Crítica · 10.0 CWE-266 05/10/2026

Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization

A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-44089 Crítica · 9.4 CWE-121 23/06/2026

Estouro de buffer baseado em pilha no login do roteador Totolink EX1200L (CVE-2026-44089)

O roteador Totolink EX1200L é vulnerável a Estouro de Buffer (Buffer Overflow) na funcionalidade de login do endpoint cgi-bin/cstecgi.cgi. Essa vulnerabilidade pode ser explorada para provocar a falha (crash) do programa e para executar código remotamente. Isso permite que o atacante realize ações como root, incluindo leitura e edição de dados, além de tornar o roteador inoperante (bricking). Como as tentativas de contato com o fornecedor não tiveram sucesso, a vulnerabilidade foi confirmada apenas na versão 9.3.5u.6146_B20201023, mas pode também afetar outras versões.

CVE-2026-11620 Média · 5.3 CWE-266 09/06/2026

TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation

A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation results in least privilege violation. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-11554 Média · 4.3 CWE-266 08/06/2026

TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation

A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. This manipulation causes least privilege violation. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-11494 Média · 4.3 CWE-266 08/06/2026

TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation

A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-10187 Crítica · 9.8 CWE-119 31/05/2026

Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

A vulnerability was detected in Totolink N300RH 6.1c.1353_B20190305. Affected by this issue is the function setWiFiBasicConfig of the file wireless.so of the component Web Management Interface. Performing a manipulation of the argument KeyStr results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

CVE-2026-9543 Crítica · 9.8 CWE-77 26/05/2026

Injeção de Comando no Sistema Operacional em setPasswordCfg (cstecgi.cgi) da Interface Web do Totolink N300RH

Foi identificada uma vulnerabilidade no Totolink N300RH 6.1c.1353_B20190305. Afetada está a função setPasswordCfg do arquivo /cgi-bin/cstecgi.cgi do componente Web Management Interface. Tal manipulação do argumento admpass leva a injeção de comando no sistema operacional. O ataque pode ser executado remotamente. O exploit foi divulgado ao público e pode ser utilizado.

CVE-2026-9534 Média · 6.3 CWE-77 26/05/2026

Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection

A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument PIN can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

CVE-2026-9533 Média · 6.3 CWE-77 26/05/2026

Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The impacted element is the function recvUpgradeNewFw of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Performing a manipulation of the argument fwUrl/magicid results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVE-2026-9532 Média · 6.3 CWE-77 26/05/2026

Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection

A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument FileName leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVE-2026-9531 Média · 6.3 CWE-77 26/05/2026

Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection

A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-9515 Média · 6.3 CWE-77 25/05/2026

Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument plugin_version results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

CVE-2026-9514 Média · 6.3 CWE-77 25/05/2026

Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection

A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. Impacted is the function setNetworkDiag of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument NetDiagHost/NetDiagPingNum/NetDiagPingSize/NetDiagPingTimeOut/NetDiagTracertHop is directly passed by the attacker/so we can control the NetDiagHost/NetDiagPingNum/NetDiagPingSize/NetDiagPingTimeOut/NetDiagTracertHop leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-9513 Média · 6.3 CWE-77 25/05/2026

Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection

A weakness has been identified in Totolink CA750-PoE 6.2c.510. This issue affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument host_time can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-9512 Média · 6.3 CWE-77 25/05/2026

Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection

A security flaw has been discovered in Totolink CA750-PoE 6.2c.510. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Performing a manipulation of the argument admuser/admpass results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-9511 Média · 6.3 CWE-77 25/05/2026

Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection

A vulnerability was identified in Totolink CA750-PoE 6.2c.510. This affects the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Such manipulation of the argument webWlanIdx leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVE-2026-9478 Crítica · 9.8 CWE-77 25/05/2026

Injeção de Comando no Sistema Operacional em setParentalRules do cstecgi.cgi da Interface Web do Totolink A8000RU

Foi identificada uma fraqueza no Totolink A8000RU 7.1cu.643_b20200521. É afetada a função setParentalRules do arquivo /cgi-bin/cstecgi.cgi do componente Web Management Interface. A manipulação do argumento enable pode levar a injeção de comando no sistema operacional. O ataque pode ser realizado remotamente. O exploit foi disponibilizado ao público e pode ser usado em ataques.

CVE-2026-9477 Crítica · 9.8 CWE-77 25/05/2026

Injeção de comando do SO no cstecgi.cgi (setAccessDeviceCfg) do Totolink A8000RU

Foi identificada uma falha de segurança no Totolink A8000RU 7.1cu.643_b20200521. Este problema afeta a função setAccessDeviceCfg do arquivo /cgi-bin/cstecgi.cgi do componente Interface de Gerenciamento Web. A manipulação do argumento mac resulta em injeção de comando do sistema operacional. O ataque pode ser realizado remotamente. O exploit foi divulgado publicamente e pode ser usado em ataques.

CVE-2026-9476 Crítica · 9.8 CWE-77 25/05/2026

Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used.

CVE-2026-9475 Crítica · 9.8 CWE-77 25/05/2026

Injeção de Comando no Totolink A8000RU em setIpQosRules (CVE-2026-9475)

Foi identificada uma vulnerabilidade no Totolink A8000RU 7.1cu.643_b20200521. Ela afeta a função setIpQosRules do arquivo /cgi-bin/cstecgi.cgi do componente Web Management Interface. Essa manipulação do argumento Comment causa injeção de comando de sistema operacional. A exploração remota do ataque é possível. O exploit foi divulgado publicamente e pode ser utilizado.

CVE-2026-9458 Crítica · 9.8 CWE-77 25/05/2026

Totolink A8000RU Interface Web de Gerenciamento cstecgi.cgi setWanCfg Injeção de Comando no SO

Foi identificada uma vulnerabilidade no Totolink A8000RU 7.1cu.643_b20200521. O elemento afetado é a função setWanCfg do arquivo /cgi-bin/cstecgi.cgi do componente Interface Web de Gerenciamento. A manipulação do argumento possibilitada leva a injeção de comando no sistema operacional. O ataque pode ser realizado remotamente. O exploit está publicamente disponível e pode ser utilizado.

CVE-2026-9457 Crítica · 9.8 CWE-77 25/05/2026

Injeção de Comando na Interface Web do Totolink A8000RU (CVE-2026-9457)

Foi identificada uma vulnerabilidade no Totolink A8000RU 7.1cu.643_b20200521. O elemento afetado é a função UploadFirmwareFile do arquivo /cgi-bin/cstecgi.cgi do componente Web Management Interface. Esta manipulação do argumento FileName causa injeção de comando no sistema operacional. O ataque pode ser realizado remotamente. O exploit foi divulgado publicamente e pode ser utilizado.