CVE-2025-25579

The TOTOLINK A3002R router (version 4.0.0-B20230531.1404 ) is vulnerable to Command Injection in the /bin/boa executable. The root cause is the failure to correctly filter special characters and commands within the bandstr variable, which also affects the formMapDelDevice function in the micropro...

CVE-2025-25579: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr...

CVE-2025-25579

TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr...

TOTOLINK A3000RU Access Control Error Vulnerability

The TOTOLINK A3000RU is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3000RU suffers from an Access Control Error vulnerability that originates from improper access control in the Syslog profile handling component in the file /cgi-bin/ExportSyslog.sh. No details of the...

PT-2025-13578

Name of the Vulnerable Software and Affected Versions TOTOLINK A3100R version 4.1.2cu.5247 B20211129 Description An issue in TOTOLINK A3100R allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste modules/wireless.so. Recommendations As a temporary workaroun...

CVE-2025-28256

An issue in TOTOLINK A3100R V4.1.2cu.5247B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cstemodules/wireless.so...

CVE-2025-28138

The TOTOLINK A800R V4.1.2cu.5137B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28138

The TOTOLINK A800R V4.1.2cu.5137B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

CVE-2025-28135

TOTOLINK A810R V4.1.2cu.5182B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi...

CVE-2025-28135

TOTOLINK A810R V4.1.2cu.5182B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi...

PT-2025-13265

Name of the Vulnerable Software and Affected Versions TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description The issue concerns a remote command execution flaw. Unauthenticated attackers can run arbitrary commands. There have been spotted exploits. It is recommended to monitor logs...

CVE-2025-28135

TOTOLINK A810R V4.1.2cu.5182B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi...

TOTOLINK X18 Router Sub 410C80 Function Arbitrary Command Execution

The vulnerability of the sub410C80 function in the cstecgi.cgi script of the TOTOLINK X18 router’s microprogramming system is related to the lack of data cleaning measures at the control level when processing the mtkhnatEnable parameter. Exploiting this vulnerability allows an attacker to execute...

PT-2025-13276

Name of the Vulnerable Software and Affected Versions TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description A buffer overflow issue was discovered in the downloadFile.cgi of the TOTOLINK A810R. Recommendations For TOTOLINK A810R version 4.1.2cu.5182 B20201026, as a temporary workaround,...

TOTOLINK A810R security vulnerabilities

The TOTOLINK A810R is a wireless dual-band router from China's Gion Electronics TOTOLINK. The TOTOLINK A810R suffers from a buffer overflow vulnerability that originates from downloadFile.cgi failing to properly validate the length and size of input data, which can be exploited by an attacker to...

CVE-2025-28135: Stack-based Buffer Overflow

TOTOLINK A810R V4.1.2cu.5182B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi...

CVE-2025-28138

The TOTOLINK A800R wireless router (firmware version V4.1.2cu.5137_B20200730 ) is vulnerable to a pre-auth remote command execution vulnerability. The flaw exists in the setNoticeCfg function due to improper neutralization of special elements in the NoticeUrl parameter. An unauthenticated attacke...

CVE-2025-28135

The TOTOLINK A810R wireless dual-band router (specifically version 4.1.2cu.5182_B20201026 ) is susceptible to a stack-based buffer overflow vulnerability in the downloadFile.cgi script. The root cause is the script's failure to properly validate the length and size of input data. An attacker expl...

CVE-2025-28138

TOTOLINK A800R V4.1.2cu.5137B20200730 contains a remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...

TOTOLINK A800R: Operating System Command Injection Vulnerability

The TOTOLINK A800R is a wireless router manufactured by TOTOLINK. A command execution vulnerability exists in the TOTOLINK A800R. The vulnerability stems from a flaw in the processing of user input via the NoticeUrl parameter in the setNoticeCfg function, which can be exploited by an attacker to...