CVE-2023-46993

In TOTOLINK A3300R V17.0.0cu.557B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection...

CVE-2023-46992

TOTOLINK A3300R V17.0.0cu.557B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authentication by visiting specific pages...

CVE-2023-46977

TOTOLINK LR1200GB V9.1.0u.6619B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth...

CVE-2023-46977

The CVE-2023-46977 entry affects TOTOLINK LR1200GB version 9.1.0u.6619_B20230130, where a stack overflow is triggered by the password parameter in the loginAuth function. Multiple sources corroborate a boundary/stack overflow that could allow remote execution of code or cause a denial of service....

TOTOLINK X6000R 安全漏洞

TOTOLINK X6000R is a wireless router from China Gion Electronics that supports WiFi 6 technology with high concurrent connections and dual-band transmission. A code execution vulnerability exists in TOTOLINK X6000R. The vulnerability stems from the application failing to properly filter special...

CVE-2023-46993

In TOTOLINK A3300R V17.0.0cu.557B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection...

PT-2023-30280 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.852 B20230719 Description: A command injection issue was found via the enable parameter in the setLedCfg function. This allows for potential command injection attacks. Recommendations: For TOTOLINK X6000R versi...

CVE-2023-46976

TOTOLINK A3300R 17.0.0cu.557B20221024 contains a command injection via the filename parameter in the UploadFirmwareFile function...

CVE-2023-46484

CVE-2023-46484 affects TOTOLINK X6000R firmware 9.4.0cu.852_B20230719, with a vulnerability in the setLedCfg function that allows a remote attacker to execute arbitrary code. The CVSS v3.1 base score is 9.8 (CRITICAL), with network access, no user interaction, and no privileges required; confiden...

CVE-2023-46993

The CVE-2023-46993 entry applies to TOTOLINK A3300R, specifically v17.0.0cu.557_B20221024, where the setLedCfg handler does not validate the enable parameter, enabling potential command injection. The issue is documented across multiple sources (NVD, CNVD/CNNVD, Red Hat, CVE listing, PT Security)...

CVE-2023-46978

CVE-2023-46978 affects TOTOLINK X6000R, specifically version 9.4.0cu.852_B20230719. The root cause is an Incorrect Access Control issue that allows attackers to reset the device’s login password and Wi‑Fi password without authentication. Multiple connected sources corroborate this vulnerability a...

PT-2023-30277 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue concerns a command injection via the file name parameter in the UploadFirmwareFile function. Recommendations: For TOTOLINK A3300R version 17.0.0cu.557 B20221024, avoid usin...

PT-2023-30286 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue arises when handling the setLedCfg request, where there is no verification for the enable parameter. This lack of verification can lead to command injection. Recommendation...

The vulnerability of the settings/setTracerouteCfg component in the TOTOLINK X5000R router software allows a malicious actor to execute arbitrary commands and gain full access to the device.

The vulnerability of the settings/setTracerouteCfg component of the TOTOLINK X5000R router software exists because measures to neutralize the special elements used in the operating system commands have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

PT-2023-9693 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue is related to incorrect access control, allowing attackers to reset critical passwords without authentication by visiting specific pages, such as /wizard.html or...

TOTOLINK X2000R Gh formTcpipSetup Method Buffer Overflow Vulnerability

TOTOLINK X2000R Gh is a WiFi 6 router from China's Gion Electronics TOTOLINK, which supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability that originates from the formTcpipSetup...

TOTOLINK X2000R Gh formSetLg Method Buffer Overflow Vulnerability

TOTOLINK X2000R Gh is a WiFi 6 router from China's Gion Electronics TOTOLINK, which supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability that stems from the formSetLg method faili...

TOTOLINK X2000R Gh formMeshUploadConfig Method Buffer Overflow Vulnerability

TOTOLINK X2000R Gh is a WiFi 6 router from China's Gion Electronics TOTOLINK, which supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability that stems from the formMeshUploadConfig...

TOTOLINK X2000R Gh formParentControl Method Buffer Overflow Vulnerability

OTOLINK X2000R Gh is a WiFi 6 router from China's Gion Electronics TOTOLINK, which supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability that stems from the formParentControl metho...

TOTOLINK X2000R Gh formNtp Method Buffer Overflow Vulnerability

TOTOLINK X2000R Gh is a WiFi 6 router from China's Gion Electronics TOTOLINK, which supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability that stems from the formNtp method failing...