Vulnerabilidades de Totolink

CVE-2025-67445 Alta · 7.5 CWE-400 24/02/2026

Uncontrolled Resource Consumption em Totolink X5000r Firmware

TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variable and allocates memory using malloc (CONTENT_LENGTH + 1) without sufficient bounds checking. When lighttpd s request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, leading to a crash of the management CGI and loss of availability of the web interface.

CVE-2025-70328 Alta · 8.8 CWE-78 23/02/2026

OS Command Injection em Totolink X6000r Firmware

TOTOLINK X6000R v9.4.0cu.1498_B20250826 contains an OS command injection vulnerability in the NTPSyncWithHost handler of the /usr/sbin/shttpd executable. The host_time parameter is retrieved via sub_40C404 and passed to a date -s shell command through CsteSystem. While the first two tokens of the input are validated, the remainder of the string is not sanitized, allowing authenticated attackers to execute arbitrary shell commands via shell metacharacters.

CVE-2025-70327 Crítica · 9.8 CWE-88 23/02/2026

Argument Injection em Totolink X5000r Firmware

TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The ip parameter is retrieved via websGetVar and passed to a ping command through CsteSystem without validating if the input starts with a hyphen (-). This allows remote authenticated attackers to inject arbitrary command-line options into the ping utility, potentially leading to a Denial of Service (DoS) by causing excessive resource consumption or prolonged execution.

CVE-2025-70329 Alta · 8.0 CWE-78 23/02/2026

OS Command Injection em Totolink X5000r Firmware

TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable. The vlanVidLan1 (and other vlanVidLanX) parameters are retrieved via Uci_Get_Str and passed to the CsteSystem function without adequate validation or filtering. This allows an authenticated attacker to execute arbitrary shell commands with root privileges by injecting shell metacharacters into the affected parameters.

CVE-2026-26736 Alta · 8.8 CWE-787 17/02/2026

Out-of-bounds Write em Totolink A3002ru Firmware

TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.

CVE-2026-26732 Alta · 8.8 CWE-787 17/02/2026

Out-of-bounds Write em Totolink A3002ru Firmware

TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter function.

CVE-2026-26731 Alta · 8.8 CWE-787 17/02/2026

Out-of-bounds Write em Totolink A3002ru Firmware

TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function.

CVE-2026-2167 Alta · 8.8 CWE-78 08/02/2026

Totolink WA300 cstecgi.cgi setAPNetwork os command injection

A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.

CVE-2025-67189 Média · 6.5 CWE-120 03/02/2026

Classic Buffer Overflow em Totolink A950rg Firmware

A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly validated, and the function concatenates multiple user-controlled fields into a fixed-size stack buffer without performing boundary checks. A remote attacker can exploit this flaw to cause denial of service or potentially achieve arbitrary code execution.

CVE-2025-67188 Crítica · 9.8 CWE-120 03/02/2026

Estouro de buffer na pilha em setRadvdCfg do TOTOLINK A950RG (CVE-2025-67188)

Existe uma vulnerabilidade de estouro de buffer em TOTOLINK A950RG V4.1.2cu.5204_B20210112. O problema reside na interface setRadvdCfg do módulo /lib/cste_modules/ipv6.so. A função não valida corretamente o tamanho do parâmetro radvdinterfacename, controlado pelo usuário, permitindo que atacantes remotos acionem um estouro de buffer na pilha.

CVE-2025-67187 Crítica · 9.8 CWE-121 03/02/2026

Estouro de buffer baseado em pilha no setIpQosRules do TOTOLINK A950RG

Um estouro de buffer baseado em pilha foi identificado no TOTOLINK A950RG V4.1.2cu.5204_B20210112. A falha existe na interface setIpQosRules do arquivo /lib/cste_modules/firewall.so, onde o parâmetro comment não é devidamente validado quanto ao tamanho.

CVE-2025-67186 Crítica · 9.8 CWE-120 03/02/2026

Estouro de buffer em setUrlFilterRules do TOTOLINK A950RG (CVE-2025-67186)

O TOTOLINK A950RG V4.1.2cu.5204_B20210112 contém uma vulnerabilidade de estouro de buffer na interface setUrlFilterRules de /lib/cste_modules/firewall.so. A vulnerabilidade ocorre porque o parâmetro url não é devidamente validado quanto ao tamanho, permitindo que atacantes remotos acionem um estouro de buffer, potencialmente levando à execução arbitrária de código ou negação de serviço.

CVE-2026-1723 Crítica · 9.2 CWE-78 30/01/2026

Injeção de comando do SO no TOTOLINK X6000R (CVE-2026-1723)

Neutralização imprópria de elementos especiais usados em um comando do SO ('Injeção de Comando do SO') vulnerabilidade em TOTOLINK X6000R permite Injeção de Comando do SO.Este problema afeta X6000R: até V9.4.0cu.1498_B20250826.

CVE-2026-1686 Alta · 8.8 CWE-119 30/01/2026

Totolink A3600R app.so setAppEasyWizardConfig buffer overflow

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-1623 Média · 6.3 CWE-74 29/01/2026

Totolink A7000R cstecgi.cgi setUpgradeFW command injection

A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1601 Média · 6.3 CWE-74 29/01/2026

Totolink A7000R cstecgi.cgi setUploadUserData command injection

A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument FileName can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1548 Alta · 8.8 CWE-77 28/01/2026

Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection

A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url causes command injection. The attack can be initiated remotely. The exploit has been published and may be used.

CVE-2026-1547 Crítica · 9.8 CWE-77 28/01/2026

Injeção de comando no firmware Totolink A7000R em cstecgi.cgi (CVE-2026-1547)

Foi detectada uma vulnerabilidade no Totolink A7000R 4.1cu.4154. Isso afeta a função setUnloadUserData do arquivo /cgi-bin/cstecgi.cgi. A manipulação do argumento plugin_name resulta em injeção de comando. É possível lançar o ataque remotamente. O exploit agora está público e pode ser usado.

CVE-2026-1328 Alta · 8.8 CWE-119 22/01/2026

Totolink NR1800X POST Request cstecgi.cgi setWizardCfg buffer overflow

A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

CVE-2026-1327 Alta · 8.8 CWE-74 22/01/2026

Totolink NR1800X POST Request cstecgi.cgi setTracerouteCfg command injection

A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-1326 Alta · 8.8 CWE-74 22/01/2026

Totolink NR1800X POST Request cstecgi.cgi setWanCfg command injection

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument Hostname causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1158 Alta · 8.8 CWE-119 19/01/2026

Totolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflow

A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-1157 Alta · 8.8 CWE-119 19/01/2026

Totolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflow

A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVE-2026-1156 Alta · 8.8 CWE-119 19/01/2026

Totolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflow

A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-1155 Alta · 8.8 CWE-119 19/01/2026

Totolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflow

A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.