CVE-2026-10131

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-10131

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-10131

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

CVE-2026-10131

The Totolink X2000R router (specifically version TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 ) contains an OS command injection vulnerability in its boa web administration binary. The flaw exists within the formPasswordSetup() function, where the application fails to sanitize the newPass input param...

EUVD-2026-105331

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-118636

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

Totolink X2000R boa formPasswordSetup OS command injection vulnerability

Summary An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

TOTOLINK X2000R Command Injection Vulnerability

The TOTOLINK X2000R has a command injection vulnerability. This vulnerability stems from the OS command injection present in the boa formPasswordSetup function. Attackers can execute arbitrary code through specially crafted HTTP requests...

Zyxel NWA1100-N security vulnerabilities

The Zyxel NWA1100-N is a wireless access point produced by the Chinese company Zyxel. The version 1.00AACE.1C0 of the Zyxel NWA1100-N contains a security vulnerability. This vulnerability stems from buffer overflows in the formWep, formWlAc, formPasswordSetup, formUpgradeCert, and formDelcert...

CVE-2023-51135

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup...

CVE-2023-51135

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup...

CVE-2023-51135

Product affected: TOTOLINK X2000R GhComponent/Function: formPasswordSetupRoot cause: stack overflow due to improper input length validationImpact (as documented): potential arbitrary code execution or denial of serviceExploitation status: not provided in the documentsPatches/Remediation: no patch...

CVE-2023-51135

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup...

CVE-2023-51135: Out-of-bounds Write

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup...

PT-2023-31771

Name of the Vulnerable Software and Affected Versions TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web Description A stack overflow issue was discovered via the function formPasswordSetup. This issue affects the TOTOLINK X2000R Gh router. Recommendations For TOTOLINK X2000R Gh version...

PT-2023-19399 · Trendnet · Trendnet Wireless Ac Easy-Upgrader Tew-820Ap

Name of the Vulnerable Software and Affected Versions: TrendNet Wireless AC Easy-Upgrader TEW-820AP version 1.0R, firmware version 1.01.B01 Description: The issue is related to a stack overflow via the newpass parameter at the "/formPasswordSetup" API endpoint. This allows attackers to execute...

CVE-2018-13315

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

CVE-2018-13315

CVE-2018-13315 affects TOTOLINK A3002RU (firmware 1.0.8). The Root Cause is incorrect access control in formPasswordSetup, enabling an unauthenticated POST to change the administrator password. As per NVD, the CVSS‑3 base score is 9.8 (CRITICAL; NETWORK, no user interaction, high confidentiality/...

CVE-2018-13315: Improper Input Validation

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request...

PT-2018-11738

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue is related to incorrect access control in the formPasswordSetup function, allowing attackers to change the admin user's password via an unauthenticated POST request to the /formPasswordSetup...