TOTOLINK N600R 安全漏洞

TOTOLINK N600R is a dual-band wireless router launched by Korean brand TOTOLINK in 2013, which supports 2.4GHz and 5GHz dual-band concurrency with a maximum wireless transmission rate of 300Mbps. The TOTOLINK N600R suffers from a stack buffer overflow vulnerability, which stems from the failure o...

CVE-2025-60335

The TOTOLINK N600R router, specifically version v4.3.0cu.7866_B20220506 , is vulnerable to a NULL pointer dereference in its main function . This flaw can be triggered by a specially crafted HTTP request , potentially affecting the cstecgi.cgi microprogramming software. Successful exploitation al...

CVE-2025-60336

A NULL pointer dereference in the sub41773C function of TOTOLINK N600R v4.3.0cu.7866B20220506 allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

PT-2025-43374

Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7866 B20220506 Description The TOTOLINK N600R device contains a stack overflow in the setWiFiMultipleConfig function due to a flaw in the wepkey2 parameter. This issue allows attackers to cause a Denial of Servic...

CVE-2025-60334

The TOTOLINK N600R dual-band wireless router, specifically version v4.3.0cu.7866_B20220506 , is susceptible to a stack-based buffer overflow vulnerability. The root cause is the failure of the ssid parameter within the setWiFiBasicConfig function to properly validate the length of the input data....

CVE-2025-60335

A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866B20220506 allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

CVE-2025-60336

A NULL pointer dereference in the sub41773C function of TOTOLINK N600R v4.3.0cu.7866B20220506 allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

CVE-2025-60333

TOTOLINK N600R v4.3.0cu.7866B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-60336

The TOTOLINK N600R router (version 4.3.0cu.7866_B20220506 ) is vulnerable to a NULL pointer dereference within the sub_41773C function. This flaw occurs during the processing of a specially crafted HTTP request , which can be exploited by an attacker to cause a Denial of Service (DoS) or service ...

CVE-2025-60333

The TOTOLINK N600R dual-band wireless router, specifically version 4.3.0cu.7866_B20220506 , is vulnerable to a stack-based buffer overflow in the setWiFiMultipleConfig function. The root cause is the wepkey2 parameter, which fails to properly validate the length of the input data. A remote attack...

VulnCheck KEV: CVE-2025-3987

A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been...

PT-2025-48843

Уязвимость функции sub 422794 микропрограммного обеспечения роутеров TOTOLINK A7000R связана с переполнением буфера в стеке. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

PT-2025-48842

Уязвимость функции sub 421CF0 микропрограммного обеспечения роутеров TOTOLINK A7000R связана с переполнением буфера в стеке. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Researchers Warn RondoDox Botnet is Weaponizing Over 50 Flaws Across 30+ Vendors

Malware campaigns distributing the RondoDox botnet have expanded their targeting focus to exploit more than 50 vulnerabilities across over 30 vendors. The activity, described as akin to an "exploit shotgun" approach, has singled out a wide range of internet-exposed infrastructure, including...

Totolink N600R SetWiFiBasicConfig Code Execution

The vulnerability of the setWiFiBasicConfig function in the Totolink N600R router’s microprogramming system lies in the fact that the operation’s output escapes outside the buffer in memory when processing the wepkey parameter. Exploiting this vulnerability allows a remote attacker to execute...

TOTOLINK X18 setEasyMeshAgentCfg Function Command Injection Vulnerability

TOTOLINK X18 is a Mesh WiFi 6 router system from TOTOLINK Taiwan, which supports WiFi 6 technology and optimizes home network coverage through the mesh function. TOTOLINK X18 suffers from a command injection vulnerability that stems from the failure of the agentName parameter in the...

TOTOLINK X18 setEasyMeshAgentCfg function mac parameter command injection vulnerability

TOTOLINK X18 is a Mesh WiFi 6 router system from TOTOLINK Taiwan, which supports WiFi 6 technology and optimizes home network coverage through the mesh function. TOTOLINK X18 suffers from a command injection vulnerability that stems from the mac parameter in the setEasyMeshAgentCfg function faili...

TOTOLINK N600R /cgi-bin/cstecgi.cgi file buffer overflow vulnerability

The TOTOLINK N600R is a dual-band wireless router launched by Korean brand TOTOLINK in 2013, supporting concurrent operation in the 2.4GHz and 5GHz bands with a maximum wireless transfer rate of 300Mbps. The TOTOLINK N600R suffers from a buffer overflow vulnerability that originates from the...

PT-2025-43921

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description A flaw exists in TOTOLINK A3300R version 17.0.0cu.557 B20221024 that allows for remote manipulation of the enable argument within the setSyslogCfg function located in the...

PT-2025-43897

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description A flaw exists in TOTOLINK A3300R that allows for remote attacks. The issue is a stack-based buffer overflow within the setLanguageCfg function located in the /cgi-bin/cstecgi.cgi file,...