PT-2025-10131

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical issue has been found in TOTOLINK EX1800T, affecting the function setRptWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument loginpass leads to a...

PT-2025-10125

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability was found in TOTOLINK EX1800T, affecting the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the arguments mode, week, minute,...

PT-2025-10124

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability has been found in TOTOLINK EX1800T. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os...

PT-2025-10123

Name of the Vulnerable Software and Affected Versions TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description A critical issue was found in the setWiFiExtenderConfig function of the /cgi-bin/cstecgi.cgi file. The manipulation of the apcliKey/key argument leads to os command injection. This...

CVE-2025-2095: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-2097: Stack-based Buffer Overflow

A vulnerability, which was classified as critical, has been found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This issue affects the function setRptWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument loginpass leads to stack-based buffer overflow. The attack may be initiat...

CVE-2025-2096: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This vulnerability affects the function setRebootScheCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mode/week/minute/recHour leads to os command injection. The attack can be initiat...

CVE-2025-2094: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. It has been rated as critical. Affected by this issue is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliKey/key leads to os command injection. The attack may be launche...

PT-2025-9254

Name of the Vulnerable Software and Affected Versions Totolink EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability has been found in the Totolink EX1800T, affecting the loginAuth function of the file /cgi-bin/cstecgi.cgi. The manipulation of the password argument leads to ...

CVE-2025-1829: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mtkhnatEnable leads to os command injection. The attack can be initiated...

CVE-2025-1392: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/webproc?getpage=html/index.html&var:menu=24gwlan&var:page=24Gbasic. The manipulation of the argument SSID leads to cross site...

CVE-2025-1340

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit...

CVE-2025-1340: Stack-based Buffer Overflow

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit...

CVE-2025-1339: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit...

VulnCheck KEV: CVE-2024-2353

A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.85220230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be...

The vulnerability of the setVpnAccountCfg() function (located in web/cgi-bin/cstecgi.cgi) in the TOTOLINK X5000R router’s microprogramming software allows a malicious actor to execute arbitrary commands.

The vulnerability of the setVpnAccountCfg function located at web/cgi-bin/cstecgi.cgi in the TOTOLINK X5000R router’s microprogramming software is related to the failure to eliminate special elements used in the operating system’s command processing when handling the pass parameter. Exploiting th...

PT-2025-3383

Name of the Vulnerable Software and Affected Versions TOTOLINK X5000R version V9.1.0cu.2350 B20230313 Description The issue is related to the setVpnAccountCfg function in the TOTOLINK X5000R router's firmware, specifically with the pass parameter. It allows an attacker to inject operating system...

PT-2026-3432

Name of the Vulnerable Software and Affected Versions Totolink LR350 version 9.3.5u.6369 B20220309 Description A flaw exists in the Totolink LR350 device. This issue is located within the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi file, part of the POST Request Handler component...

PT-2025-3384 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version V9.1.0cu.2350 B20230313 Description: The issue is related to the setVpnAccountCfg function, specifically the /web/cgi-bin/cstecgi.cgi endpoint, where the desc parameter is not properly sanitized, allowing an attacker t...

PT-2024-9966

Name of the Vulnerable Software and Affected Versions: Netis Wifi6 Router NX10 versions 2.0.1.3582 through 2.0.1.3643 Netis Wifi 11AC Router NC65 version 3.0.0.3749 Netis Wifi 11AC Router NC63 versions 3.0.0.3327 through 3.0.0.3503 Netis Wifi 11AC Router NC21 versions 3.0.0.3329 through 3.0.0.380...