PT-2025-31029 · Totolink · Totolink X15

Name of the Vulnerable Software and Affected Versions: TOTOLINK X15 version 1.0.0-B20230714.1105 Description: A critical buffer overflow vulnerability exists in the HTTP POST Request Handler component of TOTOLINK X15. The vulnerability is located in the /boafrm/formRoute file and occurs due to...

CVE-2025-7952

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been...

TOTOLink T6 Mesh System Code Execution

The vulnerability of the updateWifiInfo function in the MQTT service of the TOTOLink T6 mesh-system’s microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

TOTOLink T6 System Arbitrary Command Execution

The vulnerability of the cckeckKeepAlive function in the TOTOLink T6 mesh-system’s software lies in the lack of measures taken to neutralize special elements during the processing of the ipAddr parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLink T6 MQTT Code Execution

The vulnerability of the recvSlaveUpgstatus function in the MQTT service of the TOTOLink T6 mesh-system’s micro-programming system is related to the issue of operations going out of the buffer in memory when processing the parameter s. Exploiting this vulnerability allows a malicious actor to...

CVE-2025-44655

In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chrootlocaluser option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks...

TOTOLink T6 MQTT Code Execution

The vulnerability of the recvSlaveStaInfo function in the MQTT service of the TOTOLink T6 mesh-system’s microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the dest parameter. Exploiting this vulnerability allows a remote attacker to...

TOTOLink T6 Software Code Execution

The vulnerability of the setDiagnosisCfg function in the cstecgi.cgi script of the mesh-system TOTOLink T6 software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the ip parameter. Exploiting this vulnerability allows a remote attacker to execut...

TOTOLINK A3300R Sub Function Command Execution

The vulnerability of the sub4197C0 function in TOTOLINK A3300R router microprogramming systems is related to the lack of measures taken to neutralize special elements during the processing of mac and desc parameters. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

TOTOLINK T6 Missing Authentication Vulnerability

TOTOLINK T6 is a wireless dual-band router from China's TOTOLINK Electronics TOTOLINK that supports MQTT protocol and Telnet service. The TOTOLINK T6 suffers from a lack of authentication vulnerability that stems from the setTelnetCfg function of the /cgi-bin/cstecgi.cgi file in the component...

CVE-2025-7913

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the argument serverIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit ha...

CVE-2025-7912

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated remotely. The exploit h...

CVE-2025-7952

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-7952

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-7952 TOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-7952 TOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-7952

CVE-2025-7952 affects TOTOLINK T6 (firmware 4.1.5cu.748) with a command injection in the MQTT Packet Handler’s wireless.so, specifically the checkKeepAlive function. Root cause: improper handling of constructed commands leading to remote command execution. Impact: potential full system compromise...

CVE-2025-7862

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnetenabled with the input 1 leads to...

PT-2025-30740 · Totolink · Totolink A702R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A702R version 4.0.0-B20230721.1521 Description: A critical vulnerability exists in the HTTP POST Request Handler component of the affected software. The issue is a buffer overflow triggered by manipulating the service type argument...

PT-2025-30737 · Totolink · Totolink A702R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A702R version 4.0.0-B20230721.1521 Description: A critical vulnerability exists in the built-in web server boa, specifically within the /boafrm/formIpQoS file of the TOTOLINK A702R. The issue is a buffer overflow triggered by...