CVE-2025-28036: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28035: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A830R V4.1.2cu.5182B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28034: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function...

CVE-2025-28039

The TOTOLINK EX1200T (version 4.1.2cu.5232 B20210713) is vulnerable to a pre-auth remote command execution vulnerability. The root cause is the improper neutralization of special elements used in an OS command within the setUpgradeFW function, specifically via the FileName parameter. An attacker ...

CVE-2025-28039

TOTOLINK EX1200T V4.1.2cu.5232B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileName parameter...

PT-2025-17555 · Totolink · Totolink A950Rg +1

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 TOTOLINK A950RG version 4.1.2cu.5161 B20200903 Description: The issue is a pre-auth remote command execution vulnerability. It is located in the setDiagnosisCfg function and can be exploited throu...

PT-2025-17543 · Totolink · Totolink A3100R +5

Name of the Vulnerable Software and Affected Versions: TOTOLINK A800R version 4.1.2cu.5137 B20200730 TOTOLINK A810R version 4.1.2cu.5182 B20201026 TOTOLINK A830R version 4.1.2cu.5182 B20201102 TOTOLINK A950RG version 4.1.2cu.5161 B20200903 TOTOLINK A3000RU version 5.9c.5185 B20201128 TOTOLINK...

PT-2025-17570 · Totolink · Totolink A950Rg

Name of the Vulnerable Software and Affected Versions: TOTOLINK A950RG version 4.1.2cu.5161 B20200903 Description: The issue is a pre-auth remote command execution vulnerability. It is located in the setNoticeCfg function and can be exploited through the NoticeUrl parameter. Recommendations: For...

TOTOLINK's various products have security vulnerabilities

TOTOLINK A800R and others are products of China Gion Electronics TOTOLINK.TOTOLINK A800R is a wireless router.TOTOLINK A830R is a wireless dual-band router.TOTOLINK A810R is a wireless dual-band router.TOTOLINK A810R is a wireless dual-band router.TOTOLINK A810R is a wireless dual-band...

CVE-2025-28034

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function...

CVE-2025-28036

The TOTOLINK A950RG router (firmware version V4.1.2cu.5161_B20200903 ) is vulnerable to a pre-authentication remote command execution (RCE) flaw. This vulnerability exists in the setNoticeCfg function due to a failure to properly neutralize special elements within the NoticeUrl parameter. An unau...

TOTOLINK EX1200T security vulnerabilities

The TOTOLINK EX1200T is a dual-band wireless signal amplifier that is primarily used to extend the coverage of an existing wireless network. A code execution vulnerability exists in the TOTOLINK EX1200T. The vulnerability stems from the FileName parameter in the setUpgradeFW function for...

CVE-2025-28039

TOTOLINK EX1200T V4.1.2cu.5232B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileName parameter...

CVE-2025-28037: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A810R V4.1.2cu.5182B20201026 and A950RG V4.1.2cu.5161B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter...

PT-2025-17569 · Totolink · Totolink A830R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A830R version 4.1.2cu.5182 B20201102 Description: The issue is a pre-auth remote command execution vulnerability. It is located in the setNoticeCfg function and can be exploited through the NoticeUrl parameter. Recommendations: For...

CVE-2025-28038

The TOTOLINK EX1200T wireless router (specifically firmware version V4.1.2cu.5232_B20210713 ) is susceptible to a pre-auth remote command execution vulnerability. This issue exists within the setWebWlanIdx function due to the lack of measures to neutralize specific elements when processing the we...

CVE-2025-28036

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28036

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28035

The TOTOLINK A830R (version V4.1.2cu.5182_B20201102) is vulnerable to a pre-auth remote command execution vulnerability. The issue originates from the setNoticeCfg function in the microprogramming software, which fails to properly neutralize special characters in the NoticeUrl parameter. An unaut...

CVE-2025-28037

TOTOLINK routers, specifically the A800R , A810R , A830R , A950RG , A3000RU , and A3100R , are vulnerable to a pre-auth remote command execution vulnerability. The root cause is a failure in the setDiagnosisCfg function to correctly filter special characters, commands, and other elements within t...