TOTOLINK A6000R has a vulnerability related to injection attacks

The TOTOLINK A6000R is a high performance wireless router. A command injection vulnerability exists in TOTOLINK A6000R. The vulnerability stems from the mishandling of the apclicancelwps function, and no detailed vulnerability details are provided at this time...

CVE-2025-3249: Improper Neutralization of Special Elements used in a Command

A vulnerability classified as critical was found in TOTOLINK A6000R 1.0.1-B20201211.2000. Affected by this vulnerability is the function apclicancelwps of the file /usr/lib/lua/luci/controller/mtkwifi.lua. The manipulation leads to command injection. The attack can be launched remotely. The explo...

CVE-2025-29064

An issue in TOTOLINK x18 v.9.1.0cu.2024B20220329 allows a remote attacker to execute arbitrary code via the sub410E54 function of the cstecgi.cgi...

CVE-2025-29064

An issue in TOTOLINK x18 v.9.1.0cu.2024B20220329 allows a remote attacker to execute arbitrary code via the sub410E54 function of the cstecgi.cgi...

CVE-2025-29064

An issue in TOTOLINK x18 v.9.1.0cu.2024B20220329 allows a remote attacker to execute arbitrary code via the sub410E54 function of the cstecgi.cgi...

PT-2025-18662 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: The issue is related to a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This allows attackers to execute arbitrary commands ...

PT-2025-18660 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was discovered in the CloudSrvUserdataVersionCheck function via the magicid parameter. This issue allows attackers to execute arbitrary commands through a...

TOTOLINK A800R Command Execution Vulnerability

The TOTOLINK A800R is a wireless router manufactured by TOTOLINK. A command execution vulnerability exists in the TOTOLINK A800R. The vulnerability stems from a flaw in the processing of user input via the NoticeUrl parameter in the setNoticeCfg function, which can be exploited by an attacker to...

TOTOLINK A3000RU Access Control Error Vulnerability

The TOTOLINK A3000RU is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3000RU is vulnerable to an access control error vulnerability that stems from an improper access control issue in the IBMS profile handling component. No detailed vulnerability details are available at...

PT-2025-18664 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was discovered in the CloudSrvUserdataVersionCheck function through the url parameter. This issue allows attackers to execute arbitrary commands via a...

PT-2025-18661 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was discovered in the CloudSrvUserdataVersionCheck function via the svn parameter. This issue allows attackers to execute arbitrary commands through a...

PT-2025-18656 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was found in the recvUpgradeNewFw function via the fwUrl parameter, allowing attackers to execute arbitrary commands through a crafted request...

CVE-2025-29064

The TOTOLINK x18 gigabit router, specifically version v.9.1.0cu.2024_B20220329 , is vulnerable to a code execution flaw. The root cause is located in the sub_410E54 function of the cstecgi.cgi component. A remote attacker can exploit this issue to execute arbitrary commands on the device. While n...

TOTOLINK A3100R Code Execution Vulnerability

TOTOLINK A3100R is a series of wireless routers from China's Gion Electronics TOTOLINK. The TOTOLINK A3100R suffers from a code execution vulnerability that stems from setWebWlanIdx failing to properly filter construct command special characters, commands, and so on. An attacker can exploit this...

TOTOLINK X18 security vulnerabilities

The TOTOLINK X18 is a gigabit router from China's Gion Electronics. A code execution vulnerability exists in the TOTOLINK X18. The vulnerability stems from sub410E54 in cstecgi.cgi and can be exploited by an attacker to execute arbitrary commands...

CVE-2025-29064

An issue in TOTOLINK x18 v.9.1.0cu.2024B20220329 allows a remote attacker to execute arbitrary code via the sub410E54 function of the cstecgi.cgi...

TOTOLINK A810R Buffer Overflow Vulnerability

The TOTOLINK A810R is a wireless dual-band router from China's Gion Electronics TOTOLINK. The TOTOLINK A810R suffers from a buffer overflow vulnerability that originates from downloadFile.cgi failing to properly validate the length and size of input data, which can be exploited by an attacker to...

TOTOLINK A3002R Command Injection Vulnerability

TOTOLINK A3002R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3002R suffers from a command injection vulnerability that stems from bandstr failing to correctly filter construct command special characters, commands, etc. An attacker can exploit this vulnerability to...

PT-2025-18665 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was discovered in the setUpgradeFW function through the FileName parameter. This issue allows attackers to execute arbitrary commands via a manipulated...

PT-2025-18658 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: The issue is related to a command injection vulnerability in the msg process function via the Url parameter. This allows attackers to execute arbitrary commands by crafting a specifi...