IoT_vuln

TOTOLINK设备的POC： TOTOLINK LR350：CVE-2024-10654（登录绕过） TOTOLINK T6：CVE-2025-6916（登录绕过）- 要深入了解此CVE，请阅读更多内容：https://anduinbrian.github.io/posts/blogs/totolink-t6-v3/...

TOTOLink - Unauthenticated Command Injection

TOTOLink A950RG V5.9c.4050B20190424 and V4.1.2cu.5204B20210112 were discovered to contain a command injection vulnerability in the Main function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter. id: CVE-2022-25082 info: name: TOTOLink -...

TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

TOTOLINK EX1200T 4.1.2cu.5215 is susceptible to authentication bypass. An attacker can bypass login by sending a specific request through formLoginAuth.htm, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-42887 info:...

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

TOTOLINK CX-A3002RU - Remote Code Execution

An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote...

TotoLink Router setMacFilterRules - Command Injection

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function. id: CVE-2024-24328 info: name: TotoLink Router setMacFilterRules - Command Injection author: pussycat0x severity: critical description: |...

TOTOLINK EX1800T TOTOLINK EX1800T - Command Injection

TOTOLINK EX1800T V9.1.0cu.2112B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, allowing an attacker to obtain device administrator privileges. id: CVE-2024-34257 info: name: TOTOLINK EX1800T TOTOLINK EX1800T - Command Injecti...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

TOTOLINK A3700R - Command Injection

An issue in TOTOLINK A3700R v.9.1.2u.616520211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. id: CVE-2023-46574 info: name: TOTOLINK A3700R - Command Injection author: DhiyaneshDk severity: critical description: | An issue in...

TOTOLink - Unauthenticated Command Injection

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter. id: CVE-2023-30013 info: name: TOTOLink - Unauthenticated...

TOTOLINK Realtek SD Routers - Remote Command Injection

TOTOLINK Realtek SDK based routers may allow an authenticated attacker to execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through 2.0.0,...

TOTOLINK A3002RU 1.0.8 - Information Disclosure

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. id: CVE-2018-13317 info: name:...

TOTOLINK/Realtek Routers - Information Disclosure

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

TotoLink Router setPortForwardRules - Command Injection

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function. id: CVE-2024-24329 info: name: TotoLink Router setPortForwardRules - Command Injection author: pussycat0x severity: critical description...

CVE-2025-67445

概述 TOTOLINK X5000R V9.1.0cu.2415 的 Web 管理接口存在一个漏洞，允许 LAN 上的未经认证的远程攻击者通过段错误使 Web 服务崩溃。攻击者向 CGI 端点发送过大的 HTTP POST 请求，可触发内存耗尽，导致拒绝服务（DoS）。 漏洞详情 该漏洞源于固件 Lighttpd 配置中未对请求大小进行限制。具体而言，以下限制被注释掉了： root@kitploit: server.max-request-size = 16384 由于此限制未生效，CGI 端点 /cgi-bin/cstecgi.cgi 可接收极大请求体。根据固件反编译结果，CGI...

CVE-2026-82539

CVE-2026-82539 提交者：Nicola Giuffrida 信息 厂商： TOTOLINK 厂商网站： TOTOLINK 型号： A720R 固件版本： V4.1.5cu.630B20250509 固件下载地址： TOTOLINK 严重性 CVSS v4.0 基础评分：8.7（高危） 向量：CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 漏洞详情 cstecgi.cgi 固件二进制文件中存在基于栈的缓冲区溢出漏洞，允许已认证的管理员劫持进程的控制流，并执行二进制文件中的现有代码路径。攻击者可通过向...

CVE-2025-63821

CVE-2025-63821 提交者：Nicola Giuffrida 信息 厂商： TOTOLINK 厂商网站： TOTOLINK 型号： A720R 固件版本： V4.1.5cu.630B20250509 固件下载地址： TOTOLINK 严重性 CVSS v4.0 基础分：4.8（中等） 向量：CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N 漏洞详情 Validitycheck 函数对输入的净化不足，导致 setDiagnosisCfg 和 setTracerouteCfg 组件中存在参数注入。...

CVE-2020-27368

CVE-2020-27368 TOTOLINK-A702R-V1.0.0-B20161227.1023 目录索引漏洞 描述 TOTOLINK-A702R-V1.0.0-B20161227.1023 登录门户中的目录索引漏洞允许攻击者通过GET参数访问/icons/目录。 附加信息 修复措施：禁用Web服务器的目录列表。 漏洞类型 目录索引 产品供应商 TOTOLINK 受影响产品代码库 TOTOLINK-A702R-V1.0.0-B20161227.1023 - 型号 A702R（固件 V1.0.0） 受影响组件 TOTOLINK-A702R-V1.0.0-B20161227.1023...

CVE-2026-85031

A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible...