895 matches found
CVE-2026-51610
Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51640
Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain mesh neighbor information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51645
Incorrect access control in the getPasswordCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the administrative username via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51655
Incorrect access control in the getMacFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain MAC filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83342
Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the getTracerouteCfg function allows unauthenticated attackers to obtain traceroute diagnostic logs. This is achieved by sending a crafted POST request to the...
PT-2026-83188
Incorrect access control in the getDdnsStatus function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain DDNS runtime status and public IP information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
The vulnerability of the setDmzCfg function in the /cgi-bin/cstecgi.cgi file of the CGI Handler component of the TOTOLINK A8000RU router’s software, allowing a malicious user to execute arbitrary commands.
The vulnerability of the setDmzCfg function in the /cgi-bin/cstecgi.cgi file of the CGI Handler component of the TOTOLINK A8000RU router’s software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary...
CVE-2026-15204
A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415B20250515/9.1.0cu.2350B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched...
CVE-2026-15204
TOTOLINK X5000R is affected by CVE-2026-15204. The OpenVPN Export feature (file /web/cgi-bin/cstecgi.cgi, function exportOvpn) is vulnerable to path traversal. The vulnerability can be exploited remotely. Details in connected records identify the affected product/version (9.1.0cu.2415_B20250515/9...
CVE-2026-15204 TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal
A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415B20250515/9.1.0cu.2350B20230313. Affected by this vulnerability is the function exportOvpn of the file /web/cgi-bin/cstecgi.cgi of the component OpenVPN Export. The manipulation results in path traversal. The attack may be launched...
The vulnerability of the setWiFiBasicCfg() function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming software allows a attacker to execute arbitrary commands.
The vulnerability of the setWiFiBasicCfg function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming system is related to the lack of measures taken to neutralize special elements during the processing of the rxRate parameter. Exploiting this vulnerability could...
The vulnerability of the setIptvCfg() function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming software allows a intruder to execute arbitrary commands.
The vulnerability of the setIptvCfg function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming system is related to the failure to take measures to neutralize special elements during the processing of the vlanPriLan3 parameter. Exploiting this vulnerability allow...
CVE-2026-44089 Buffer Overflow in Totolink EX1200L router
Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi-bin/cstecgi.cgi endpoint. This vulnerability could be exploited to cause the program to crash and to execute code remotely. This allows the attacker to perform actions as root including reading and editing...
CVE-2026-9534
A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. Executing a manipulation of the argument PIN can lead to os command injection. It is possible to launch the attack remotely. The...
CVE-2026-9514
A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. Impacted is the function setNetworkDiag of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument NetDiagHost/NetDiagPingNum/NetDiagPingSize/NetDiagPingTimeOut/NetDiagTracertHop is...
CVE-2026-31179
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to /cgi-bin/cstecgi.cgi...
CVE-2026-31177
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi...
CVE-2026-31159
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi...