The vulnerability of the setEasyMeshAgentCfg function in the microprogramming software for TOTOLINK X18 allows a hacker to execute arbitrary commands.

The vulnerability of the setEasyMeshAgentCfg function in the microprogramming software for TOTOLINK X18 lies in the lack of measures taken to clean data at the management level when processing the agentName parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CVE-2025-61044

TOTOLINK X18 V9.1.0cu.2053B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function...

CVE-2025-61044

TOTOLINK X18 V9.1.0cu.2053B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function...

CVE-2025-61044

TOTOLINK X18 V9.1.0cu.2053B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function...

CVE-2025-61044

TOTOLINK X18 V9.1.0cu.2053B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function...

TOTOLINK X18 命令注入漏洞

TOTOLINK X18 is a Mesh WiFi 6 router system from TOTOLINK Taiwan, which supports WiFi 6 technology and optimizes home network coverage through the mesh function. TOTOLINK X18 suffers from a command injection vulnerability that stems from the failure of the agentName parameter in the...

PT-2025-40254

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version 9.1.0cu.2053 B20230309 Description The software contains a command injection issue through the agentName parameter within the setEasyMeshAgentCfg function. This allows for potential unauthorized command execution...

CVE-2025-61044

TOTOLINK X18 (firmware: 9.1.0cu.2053_B20230309) is affected by a command injection in the setEasyMeshAgentCfg function, exploitable via the agentName parameter. The vulnerability allows arbitrary command execution and is network-authless with low complexity, high impact on confidentiality, integr...

CVE-2025-61044

TOTOLINK X18 V9.1.0cu.2053B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function...

CVE-2025-61044: Improper Neutralization of Special Elements used in a Command

TOTOLINK X18 V9.1.0cu.2053B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function...

Sql injection

Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the 1 login field aka agentname parameter or 2 password field aka agentpassword parameter...

CVE-2010-1708: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the 1 login field aka agentname parameter or 2 password field aka agentpassword parameter...

CVE-2002-2305: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in agentadmin.php in Immobilier allows remote attackers to execute arbitrary SQL commands via the 1 agentname or 2 agentpassword parameter...