TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection

TOTOLINK EX1800T V9.1.0cu.2112B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges. id: CVE-2024-34257 info: name: TOTOLINK EX1800T TOTOLINK EX1800T - Command Injecti...

TOTOLink - Unauthenticated Command Injection

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter. id: CVE-2023-30013 info: name: TOTOLink - Unauthenticated...

TOTOLINK A3700R - Command Injection

An issue in TOTOLINK A3700R v.9.1.2u.616520211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. id: CVE-2023-46574 info: name: TOTOLINK A3700R - Command Injection author: DhiyaneshDk severity: critical description: | An issue in...

TOTOLINK A3002RU 1.0.8 - Information Disclosure

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. id: CVE-2018-13317 info: name:...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

TotoLink Router setPortForwardRules - Command Injection

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function. id: CVE-2024-24329 info: name: TotoLink Router setPortForwardRules - Command Injection author: pussycat0x severity: critical description...

CVE-2026-82616

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public a...

CVE-2026-82616

A stack-based buffer overflow in the setUploadSetting function of /cgi-bin/cstecgi.cgi affects TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 . The flaw is triggered by manipulating the FileName argument, allowing a remote attacker with low privileges to overflow the stack and potentially gain c...

EUVD-2026-68353

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public a...

CVE-2025-63821

CVE-2025-63821 Remitente: Nicola Giuffrida Información Fabricante: TOTOLINK Sitio web del fabricante: TOTOLINK Modelo: A720R Versión de firmware: V4.1.5cu.630B20250509 Dirección de descarga de firmware: TOTOLINK Gravedad CVSS v4.0 Puntuación base: 4.8 Media Vector:...

CVE-2026-82597

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-82597 TOTOLINK NR1800X cstecgi.cgi setUssd command injection

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-82597

A command injection vulnerability exists in TOTOLINK NR1800X (version 9.1.0u.6681_B20230703), specifically in the setUssd function of /cgi-bin/cstecgi.cgi . Manipulating the ussd argument allows a remote attacker with low privileges to inject arbitrary commands. The attack requires no user intera...

EUVD-2026-68300

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-51740

An incorrect access control vulnerability in the killProcess function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows unauthenticated attackers to terminate critical services by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific patched version is stated in the ...

CVE-2026-51717

CVE-2026-51717 is an incorrect access control vulnerability in the setOpModeCfg function of TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 . An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to change the device operating mode. No CVSS metrics are currently a...

CVE-2026-51690

CVE-2026-51690 affects the TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ). An incorrect access control flaw in the setWanCfg function allows unauthenticated attackers to alter upstream provisioning and connectivity by sending a crafted POST request to /cgi-bin/cstecgi.cgi. No specific patche...

CVE-2026-51679

TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 is affected by an incorrect access control flaw in the setPasswordCfg function. An unauthenticated remote attacker can change the administrator account password by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The vulnerability is rated ...

CVE-2026-51706

TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 contains an incorrect access control flaw in the setSmartQosCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to degrade traffic handling (QoS configuration) on the affected device. No specific expl...