CVE-2026-96515

CVE-2026-96515: ejecución autenticada de comandos como root en Netlink HG323RW Un usuario web limitado autenticado puede subir un script de shell a través del manejador de importación de diagnóstico del Netlink HG323RW y hacer que el proceso BOA con UID 0 lo ejecute. Se requieren autenticación y...

The vulnerability of the formIpv6Setup interface in the /bin/boa binary of the Totolink A3002R router’s microprogramming system allows a attacker to execute arbitrary code.

The vulnerability of the formIpv6Setup interface in the /bin/boa binary of the Totolink A3002R router’s microprogramming system is related to the copying of buffers without checking the size of the input data during the processing of the pppoedns1 parameter. Exploiting this vulnerability allows a...

EUVD-2022-43431

Malicious code in bioql PyPI...

EUVD-2025-8669

Malicious code in bioql PyPI...

EUVD-2024-20066

Malicious code in bioql PyPI...

CVE-2022-40110

TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa...

CVE-2025-25579

TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Command Injection in /bin/boa via bandstr...

CVE-2025-25579

The TOTOLINK A3002R wireless router, specifically version 4.0.0-B20230531.1404 , is vulnerable to Command Injection in the /bin/boa executable. The root cause is the bandstr variable failing to properly filter special characters and commands. An attacker can exploit this flaw to execute arbitrary...

CVE-2025-25610

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the staticgw parameter in the formIpv6Setup interface of /bin/boa...

CVE-2025-25609

TOTOlink A3002R V1.1.1-B20200824.0128 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the staticipv6 parameter in the formIpv6Setup interface of /bin/boa...

PT-2025-9131

Name of the Vulnerable Software and Affected Versions: TOTOlink A3002R version V1.1.1-B20200824.0128 Description: The issue arises from a buffer overflow due to improper input validation of the pppoe dns1 parameter in the formIpv6Setup interface of the /bin/boa endpoint. Recommendations: For...

CVE-2024-54907

TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc...

TOTOLINK A3002R 安全漏洞

The TOTOLINK A3002R is a wireless dual-band Gigabit router. A remote code injection vulnerability exists in the TOTOLINK A3002R. The vulnerability is due to the ability to execute remote code in /bin/boa via formWsc in the affected version. An attacker can exploit this vulnerability to remotely...

CVE-2024-42520

TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl...

CVE-2024-42520

TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl...

CVE-2024-42520

TOTOLINK A3002R v4.0.0-B20230531.1404 contains a buffer overflow vulnerability in /bin/boa via formParentControl...

CVE-2024-42520

CVE-2024-42520 affects TOTOLINK A3002R (v4.0.0-B20230531.1404). A buffer overflow in /bin/boa via the formParentControl endpoint is the root cause. Reported impacts include remote code execution risk and potential denial of service; CVSS indicates CRITICAL overall impact (C/H/I/A). Some sources n...

TOTOLINK A3002R 安全漏洞

TOTOLINK A3002R is a wireless dual-band Gigabit router from China's Gion Electronics TOTOLINK. A buffer overflow vulnerability exists in TOTOLINK A3002R version v4.0.0-B20230531.1404, which originates from formParentControl failing to correctly validate the length and size of the input data in...

CVE-2024-33772

A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formTcpipSetup allows remote authenticated users to trigger a denial of service DoS through the parameter "curTime."...

CVE-2024-33774

A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanSetupWizard allows remote authenticated users to trigger a denial of service DoS through the parameter "webpage."...