CVE-2025-1340

TOTOLINK X18 firmware 9.1.0cu.2024_B20220329 is affected in the setPasswordCfg function of /cgi-bin/cstecgi.cgi. The issue is a stack-based buffer overflow caused by manipulation of a String parameter, enabling a remote attacker to exploit it. Public exploit details exist, and the vendor reported...

CVE-2025-1340 TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit...

CVE-2025-1339

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit...

CVE-2025-1339

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit...

CVE-2025-1339

TOTOLINK X18 9.1.0cu.2024_B20220329 is affected by a command injection in the setL2tpdConfig function of /cgi-bin/cstecgi.cgi. The argument enable can be manipulated to execute arbitrary commands remotely. Public exploit activity is noted across multiple sources (CVE-2025-1339). Red Hat and CNVD ...

CVE-2025-1339 TOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injection

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit...

CVE-2025-1339 TOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injection

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit...

TOTOLINK X18 安全漏洞

TOTOLINK X18 is a Gigabit router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK X18 version 9.1.0cu.2024B20220329, which originates from the parameter String in the file /cgi-bin/cstecgi.cgi that fails to correctly validate the length size of the input...

TOTOLINK X18 命令注入漏洞

TOTOLINK X18 is a Gigabit router from China's Gion Electronics TOTOLINK. TOTOLINK X18 version 9.1.0cu.2024B20220329 suffers from a command injection vulnerability that stems from the parameter enable in file /cgi-bin/cstecgi.cgi failing to correctly filter constructed command special characters,...

PT-2025-6883 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description: A critical vulnerability has been found in the setPasswordCfg function of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to a stack-based buffer overflow. It is...

CVE-2024-34196

Totolink AC1200 Wireless Dual Band Gigabit Router A3002RUV3 Firmware V3.0.0-B20230809.1615 is vulnerable to Buffer Overflow. The "boa" program allows attackers to modify the value of the "vwlanidx" field via "formMultiAP". This can lead to a stack overflow through the "formWlEncrypt" CGI function...

CVE-2024-34206

TOTOLINK outdoor CPE CP450 v4.1.0cu.747B20191224 was discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter...

CVE-2024-34215

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the setUrlFilterRules function...

CVE-2024-34921

TOTOLINK X5000R v9.1.0cu.2350B20230313 was discovered to contain a command injection via the disconnectVPN function...

CVE-2024-34219

TOTOLINK CP450 V4.1.0cu.747B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet...

CVE-2024-34202

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the setMacFilterRules function...

CVE-2024-34211

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root...

CVE-2024-34212

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the CloudACMunualUpdate function...

CVE-2024-34203

TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a stack buffer overflow vulnerability in the setLanguageCfg function...

CVE-2024-32352

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an authenticated remote command execution RCE vulnerability via the "ipsecL2tpEnable" parameter in the "cstecgi.cgi" binary...