CVE-2026-105484 TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652B20230116. The impacted element is the function firmwarecheck of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument filename leads to os command injection. The attack...

CVE-2026-105484

The TOTOLINK X6000R running firmware version 9.4.0cu.652_B20230116 is vulnerable to an OS command injection vulnerability. The flaw exists within the UploadFirmwareFile Handler component, specifically in the firmware_check function of the /cgi-bin/cstecgi.cgi file. An attacker can exploit this by...

CVE-2026-82539

CVE-2026-82539 Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Severity CVSS v4.0 Base Score: 9.4 Critical Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P Vulnerability...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38407)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delPortForwardRules function. Attackers can exploit this vulnerability by sending a specially crafted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38555)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setSmartQosCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38581)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability in access control. This vulnerability stems from an incorrect access control in the UploadFirmwareFile function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38412)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delWiFiAclRules function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38561)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setUPnPCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reque...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38428)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setIpPortFilterRules function. Attackers can exploit this vulnerability by sending a specially crafted...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38580)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from incorrect access control in the UploadCustomModule function. Attackers can exploit this vulnerability by sending specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38409)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the delStaticDhcpRules function. Attackers can exploit this vulnerability by sending a specially crafted PO...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38569)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control mechanism in the setWiFiEasyGuestCf function. Attackers can exploit this vulnerability by sending a special...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38568)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the setWiFiEasyCfg function. Attackers can exploit this vulnerability by sending a specially crafted POS...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38563)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setVpnPassCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38562)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setUrlFilterRules function. Attackers can exploit this vulnerability by sending a specially crafted POS...

CVE-2026-91853 TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The...

CVE-2026-85031

A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible...

CVE-2026-85031 TOTOLINK CP450 cstecgi.cgi buffer overflow

A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible...

CVE-2026-85031

TOTOLINK CP450 firmware version 4.1.0 contains a buffer overflow in an unknown function of /cgi-bin/cstecgi.cgi, triggered by manipulating the topicurl argument. Remote exploitation is possible. The vulnerability is rated CVSS 3.1: 9.9 (Critical) with a scope change and high impact to confidentia...

EUVD-2026-70313

A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible...