Filtered by vendor Totolink Subscriptions
Total 994 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-26978 1 Totolink 2 A7100ru, A7100ru Firmware 2025-02-12 9.8 Critical
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
CVE-2023-26848 1 Totolink 2 A7100ru, A7100ru Firmware 2025-02-12 9.8 Critical
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
CVE-2023-29803 1 Totolink 2 X18, X18 Firmware 2025-02-07 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.
CVE-2023-29802 1 Totolink 2 X18, X18 Firmware 2025-02-07 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVE-2023-29801 1 Totolink 2 X18, X18 Firmware 2025-02-07 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.
CVE-2023-29800 1 Totolink 2 X18, X18 Firmware 2025-02-07 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
CVE-2023-29798 1 Totolink 2 X18, X18 Firmware 2025-02-07 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVE-2023-29799 1 Totolink 2 X18, X18 Firmware 2025-02-07 9.8 Critical
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
CVE-2023-30054 1 Totolink 2 A7100ru, A7100ru Firmware 2025-01-29 9.8 Critical
TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
CVE-2023-30053 1 Totolink 2 A7100ru, A7100ru Firmware 2025-01-29 9.8 Critical
TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
CVE-2023-30013 1 Totolink 2 X5000r, X5000r Firmware 2025-01-29 9.8 Critical
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.
CVE-2023-31856 1 Totolink 2 Cp300\+, Cp300\+ Firmware 2025-01-23 9.8 Critical
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.
CVE-2023-31729 1 Totolink 2 A3300r, A3300r Firmware 2025-01-22 9.8 Critical
TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
CVE-2023-33485 1 Totolink 2 X5000r, X5000r Firmware 2025-01-10 8.8 High
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a post-authentication buffer overflow via parameter sPort/ePort in the addEffect function.
CVE-2023-33487 1 Totolink 2 X5000r, X5000r Firmware 2025-01-10 9.8 Critical
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter.
CVE-2023-33486 1 Totolink 2 X5000r, X5000r Firmware 2025-01-09 9.8 Critical
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter.
CVE-2023-31569 1 Totolink 2 X5000r, X5000r Firmware 2025-01-08 9.8 Critical
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection via the setWanCfg function.
CVE-2023-33556 1 Totolink 2 A7100ru, A7100ru Firmware 2025-01-07 9.8 Critical
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg.
CVE-2024-10966 1 Totolink 2 X18, X18 Firmware 2024-12-17 6.3 Medium
A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-2353 1 Totolink 2 X6000r, X6000r Firmware 2024-12-17 8.8 High
A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256313 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.