PT-2025-9254

Name of the Vulnerable Software and Affected Versions Totolink EX1800T version 9.1.0cu.2112 B20220316 Description A critical vulnerability has been found in the Totolink EX1800T, affecting the loginAuth function of the file /cgi-bin/cstecgi.cgi. The manipulation of the password argument leads to ...

CVE-2025-1829: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mtkhnatEnable leads to os command injection. The attack can be initiated...

The vulnerability of the setSSServer() function in the cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the setSSServer function in the cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming system is related to the lack of measures to sanitize input data when processing parameters such as password, port, and timeout. Exploiting this vulnerability allows a remote...

The vulnerability of the setSSServer() function in the cstecgi.cgi script of the TOTOLINK X5000R router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the setSSServer function in the cstecgi.cgi script of the TOTOLINK X5000R router’s software is related to the lack of measures to sanitize input data when processing parameters such as password, port, and timeout. Exploiting this vulnerability could allow an attacker to execu...

CVE-2025-1339

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit...

PT-2025-6883 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description: A critical vulnerability has been found in the setPasswordCfg function of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to a stack-based buffer overflow. It is...

TOTOLINK X18 命令注入漏洞

TOTOLINK X18 is a Gigabit router from China's Gion Electronics TOTOLINK. TOTOLINK X18 version 9.1.0cu.2024B20220329 suffers from a command injection vulnerability that stems from the parameter enable in file /cgi-bin/cstecgi.cgi failing to correctly filter constructed command special characters,...

CVE-2025-1339: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit...

TOTOLINK X18 安全漏洞

TOTOLINK X18 is a Gigabit router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK X18 version 9.1.0cu.2024B20220329, which originates from the parameter String in the file /cgi-bin/cstecgi.cgi that fails to correctly validate the length size of the input...

CVE-2025-1340: Stack-based Buffer Overflow

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit...

The vulnerability of the setVpnAccountCfg() function (/web/cgi-bin/cstecgi.cgi) in the TOTOLINK X5000R router’s microprogramming software allows a attacker to execute arbitrary commands.

The vulnerability of the setVpnAccountCfg function /web/cgi-bin/cstecgi.cgi of the TOTOLINK X5000R router’s microprogramming software is related to the failure to eliminate special elements used in the operating system’s command when processing the user parameter. Exploiting this vulnerability...

PT-2025-3383

Name of the Vulnerable Software and Affected Versions TOTOLINK X5000R version V9.1.0cu.2350 B20230313 Description The issue is related to the setVpnAccountCfg function in the TOTOLINK X5000R router's firmware, specifically with the pass parameter. It allows an attacker to inject operating system...

PT-2026-3433

Name of the Vulnerable Software and Affected Versions Totolink LR350 version 9.3.5u.6369 B20220309 Description A security flaw exists in Totolink LR350. The issue is due to command injection within the setTracerouteCfg function of the /cgi-bin/cstecgi.cgi file, specifically in the POST Request...

CVE-2024-12352 TOTOLINK EX1800T cstecgi.cgi sub_40662C stack-based overflow

A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112B20220316. This vulnerability affects the function sub40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The...

PT-2024-9535 · Totolink · Totolink Ex1800T

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX1800T version 9.1.0cu.2112 B20220316 Description: A problematic issue has been found in the function sub 40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the ssid argument leads to a stack-based buffer overflow. The...

The vulnerability in the cgi-bin/cstecgi.cgi script of the TOTOLINK X18 Wi-Fi router’s software allows a hacker to execute arbitrary commands.

The vulnerability in the cgi-bin/cstecgi.cgi script of the TOTOLINK X18 Wi-Fi router software is related to insufficient checking of arguments passed in the command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-10966 TOTOLINK X18 cstecgi.cgi os command injection

A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024B20220329. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be launched remotel...

TOTOLINK X18 命令注入漏洞

TOTOLINK X18 is a mesh router system from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X18 version 9.1.0cu.2024B20220329, which stems from the enable parameter in the /cgi-bin/cstecgi.cgi page failing to correctly filter constructed command special...

CVE-2024-10966: Improper Neutralization of Special Elements used in an OS Command

A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024B20220329. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be launched remotel...

CVE-2024-9001

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be initiated remotely. The...