EUVD-2026-83453

A vulnerability was identified in Totolink A3002MU Hh-B20211125.1046. Affected is the function formWlEncrypt of the file /boafrm/formWlEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available a...

EUVD-2026-83448

A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Executing a manipulation of the argument submit-url can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed...

CVE-2026-93740

CVE-2026-93740 affects the Totolink A3002MU wireless router (firmware Hh-B20211125.1046 ). The vulnerability resides in the formWlEncrypt function within the file /boafrm/formWlEncrypt . Manipulating the submit-url argument triggers a buffer overflow , which can be exploited remotely without auth...

CVE-2026-93739

A buffer overflow in the formWlAc function of the file /boafrm/formWlAc on the Totolink A3002MU router (firmware Hh-B20211125.1046 ) can be triggered remotely by manipulating the submit-url argument. The vulnerability is rated CVSS 3.1: 9.9 CRITICAL (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with proo...

CVE-2026-93738

A buffer overflow vulnerability in Totolink A3002MU (firmware Hh-B20211125.1046) affects the formSchedule function within /boafrm/formSchedule. Manipulating the webpage argument triggers the overflow, enabling a remote attack with low complexity. The CVSS 3.1 score is 9.9 (CRITICAL) with scope ch...

EUVD-2026-83447

A vulnerability was found in Totolink A3002MU Hh-B20211125.1046. This affects the function formSchedule of the file /boafrm/formSchedule. Performing a manipulation of the argument webpage results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been made publ...

CVE-2025-63821

CVE-2025-63821 Soumis par : Nicola Giuffrida Informations Fournisseur : TOTOLINK Site Web du fournisseur : TOTOLINK Modèle : A720R Version du firmware : V4.1.5cu.630B20250509 Adresse de téléchargement du firmware : TOTOLINK Sévérité CVSS v4.0 Score de base : 4.8 Moyen Vecteur :...

CVE-2020-27368

CVE-2020-27368 TOTOLINK-A702R-V1.0.0-B20161227.1023 Vulnérabilité d'indexation de répertoire Description L'indexation de répertoire dans le portail de connexion de TOTOLINK-A702R-V1.0.0-B20161227.1023 permet à un attaquant d'accéder aux répertoires /icons/ via un paramètre GET. Informations...

CVE-2022-28906-POC

CVE-2022-28906 PoC Python-эксплойт для неаутентифицированной инъекции команд в TOTOLINK N600R. Уязвимость Продукт| TOTOLINK N600R ---|--- Прошивка| V5.3c.7159B20190425 Тип| Инъекция команд ОС CWE-78 Параметр| langType Конечная точка| /cgi-bin/cstecgi.cgi CVSS v3.1| 9.8 Critical В TOTOLink N600R...

CVE-2025-63820

CVE-2025-63820 Submitter: Nicola Giuffrida Information Vendor: TOTOLINK Vendor's website: TOTOLINK Model: A720R Firmware version: V4.1.5cu.630B20250509 Firmware download address: TOTOLINK Vulnerability details When logging into the control panel, the username and password are sent in plain-text:...

CVE-2024-46451

CVE-2024-46451 TOTOLINK AC1200 T8 Exploit - Vulnérabilité de dépassement de tampon Ce dépôt contient un script Python qui exploite une vulnérabilité de dépassement de tampon dans le TOTOLINK AC1200 T8 version v4.1.5cu.861B20230220 dans la fonction setWiFiAclRules via le paramètre desc. Détails de...

CVE-2026-91853

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The...

CVE-2026-37152

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

EUVD-2026-78822

A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The...

CVE-2026-91853

TOTOLINK X5000R (firmware 9.1.0cu.2089_B20211224 ) contains an OS command injection vulnerability in the Export Ovpn Handler . The exportOvpn function in /cgi-bin/cstecgi.cgi fails to properly sanitize the filetype argument, allowing a remote attacker with low privileges to inject and execute arb...

EUVD-2026-78811

TOTOLINK X5000R V9.1.0cu.2415B20250515 was discovered to contain a hardcoded password for root access...

CVE-2026-37152

TOTOLINK X5000R (firmware V9.1.0cu.2415_B20250515) contains a hardcoded root password , granting full network-level access with no authentication required. The vulnerability is rated CVSS 9.8 (Critical) with high impact to confidentiality, integrity, and availability. CISA's SSVC assessment class...

CVE-2026-90608

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument servicetype causes buffer overflow. It is possible to initiate the attack remotely. The exploit has...

CVE-2026-90607

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is no...

EUVD-2026-77141

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIpv6Setup of the file /boafrm/formIpv6Setup of the component boa. The manipulation of the argument staticipv6 leads to buffer overflow. The attack is possible to be carried out...