CVE-2024-7215

A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hosttime leads to command injection. The attack may be launched remotely. The exploit has...

CVE-2024-31807

TOTOLINK EX200 V4.0.3c.7646B20201211 was discovered to contain a remote code execution RCE vulnerability via the hostTime parameter in the NTPSyncWithHost function...

CVE-2023-51035

TOTOLINK EX1200L V9.3.5u.6146B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface...

CVE-2023-51023

TOTOlink EX1800T v9.1.0cu.2112B20220316 is vulnerable to arbitrary command execution in the ‘hosttime’ parameter of the NTPSyncWithHost interface of the cstecgi .cgi...

CVE-2022-28491

TOTOLink outdoor CPE CP900 V6.3c.566B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Totolink Router Code Execution

The vulnerability of the NTPSyncWithHost function in Totolink router microprogramming software is related to the failure to take measures to neutralize special elements of the hostTime parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2022-36479

TOTOLINK N350RT V9.3.5u.6139B20201216 was discovered to contain a command injection vulnerability via the hosttime parameter in the function NTPSyncWithHost...

TOTOLINK CA600-PoE NTPSyncWithHost Function Command Injection Vulnerability

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the NTPSyncWithHost function failing to properly filter construct command special characters, commands, etc. No detailed...

CVE-2025-44845

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44845

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44845

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44845

The TOTOLINK CA600-PoE (version V5.3c.6665_B20180820 ) is susceptible to a command injection vulnerability within the NTPSyncWithHost function. The root cause is the software's failure to properly filter or neutralize special characters and commands within the hostTime parameter, leading to a lac...

CVE-2025-44845: Improper Neutralization of Special Elements used in a Command

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

PT-2025-18666 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: The issue is related to a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This allows attackers to execute arbitrary commands via a crafte...

TOTOLINK CA600-PoE 安全漏洞

TOTOLINK CA600-PoE is an outdoor wireless AP/CPE device from China Gion Electronics TOTOLINK. TOTOLINK CA600-PoE suffers from a command injection vulnerability that stems from the NTPSyncWithHost function failing to properly filter construct command special characters, commands, etc. No detailed...

CVE-2025-28034

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function...

CVE-2025-28034

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function...

CVE-2025-28034

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function...

TOTOLINK多款产品 安全漏洞

TOTOLINK A800R and others are products of China Gion Electronics TOTOLINK.TOTOLINK A800R is a wireless router.TOTOLINK A830R is a wireless dual-band router.TOTOLINK A810R is a wireless dual-band router.TOTOLINK A810R is a wireless dual-band router.TOTOLINK A810R is a wireless dual-band...

CVE-2025-28034

Several TOTOLINK wireless routers are vulnerable to a pre-auth remote command execution vulnerability. The issue resides in the NTPSyncWithHost function due to the failure to neutralize special elements in the hostTime parameter (CWE-78). Affected models and versions include A800R (V4.1.2cu.5137_...