T6 Firmware Security Vulnerabilities and Issues — T6 Firmware CVE List

Lucene search

TotolinkT6 Firmware

39 matches found

CVE•added 2022/02/19 12:15 a.m.•209 views

CVE-2022-25134

A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

In wild

CVE•added 2022/02/24 3:15 p.m.•202 views

CVE-2022-25084

TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

9.8CVSS9.9AI score0.84255EPSS

In wild

CVE•added 2022/02/19 12:15 a.m.•90 views

CVE-2022-25130

A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

CVE•added 2022/02/19 12:15 a.m.•73 views

CVE-2022-25131

A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

CVE•added 2022/02/19 12:15 a.m.•71 views

CVE-2022-25132

A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

CVE•added 2022/07/01 6:15 p.m.•71 views

CVE-2022-32049

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/02/19 12:15 a.m.•67 views

CVE-2022-25137

A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

CVE•added 2022/02/19 12:15 a.m.•66 views

CVE-2022-25136

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

CVE•added 2022/07/01 6:15 p.m.•66 views

CVE-2022-32051

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/07/01 6:15 p.m.•64 views

CVE-2022-32046

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/07/01 6:15 p.m.•64 views

CVE-2022-32048

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88.

7.5CVSS7.8AI score0.00395EPSS

CVE•added 2022/07/01 6:15 p.m.•64 views

CVE-2022-32052

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/02/19 12:15 a.m.•62 views

CVE-2022-25135

A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

CVE•added 2022/07/01 6:15 p.m.•62 views

CVE-2022-32044

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80.

7.5CVSS7.8AI score0.00395EPSS

CVE•added 2022/02/19 12:15 a.m.•61 views

CVE-2022-25133

A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

9.8CVSS9.7AI score0.0446EPSS

CVE•added 2022/07/01 6:15 p.m.•57 views

CVE-2022-32045

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/07/01 6:15 p.m.•55 views

CVE-2022-32050

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/07/01 6:15 p.m.•53 views

CVE-2022-32053

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/09/16 3:15 p.m.•52 views

CVE-2022-38823

In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.

9.8CVSS9.4AI score0.00134EPSS

CVE•added 2022/09/16 3:15 p.m.•49 views

CVE-2022-38826

In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.

9.8CVSS9.7AI score0.00154EPSS

CVE•added 2022/07/01 6:15 p.m.•48 views

CVE-2022-32047

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4.

7.5CVSS7.7AI score0.00395EPSS

CVE•added 2022/09/16 3:15 p.m.•47 views

CVE-2022-38828

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi

9.8CVSS9.6AI score0.39632EPSS

CVE•added 2022/09/16 3:15 p.m.•46 views

CVE-2022-38827

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi

9.8CVSS9.4AI score0.12436EPSS

CVE•added 2024/01/09 2:15 p.m.•43 views

CVE-2023-7221

A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible...

10CVSS9.5AI score0.00286EPSS

CVE•added 2024/01/09 4:15 p.m.•28 views

CVE-2023-7223

A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack...

6.5CVSS6.5AI score0.00195EPSS

CVE•added 2025/07/11 10:15 p.m.•15 views

CVE-2025-7460

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. ...

9CVSS8.9AI score0.00165EPSS

CVE•added 2025/07/20 3:15 a.m.•13 views

CVE-2025-7862

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to mis...

9.8CVSS7.2AI score0.00267EPSS

CVE•added 2025/06/30 5:15 p.m.•10 views

CVE-2025-6916

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local ...

8.8CVSS8.6AI score0.00295EPSS

CVE•added 2025/07/13 9:15 a.m.•10 views

CVE-2025-7524

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. It is possible t...

8.8CVSS6.9AI score0.03023EPSS

CVE•added 2025/07/13 10:15 a.m.•9 views

CVE-2025-7525

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument command leads to command injection...

8.8CVSS6.9AI score0.03023EPSS

CVE•added 2025/07/14 3:15 p.m.•8 views

CVE-2025-7613

A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack may be in...

8.8CVSS7.8AI score0.03078EPSS

CVE•added 2025/07/14 4:15 p.m.•8 views

CVE-2025-7615

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be lau...

8.8CVSS7.1AI score0.03078EPSS

CVE•added 2025/07/17 10:15 p.m.•8 views

CVE-2025-7758

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overf...

9CVSS8.8AI score0.00165EPSS

Web

CVE•added 2025/07/19 5:15 p.m.•8 views

CVE-2025-7837

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the component MQTT Service. The manipulation of the argument dest leads to buffer overflow. The attack may be launched remotely. The exploit has been...

9CVSS8.8AI score0.00165EPSS

CVE•added 2025/07/14 3:15 p.m.•7 views

CVE-2025-7614

A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack r...

8.8CVSS7.9AI score0.03078EPSS

Web

CVE•added 2025/07/20 11:15 p.m.•7 views

CVE-2025-7912

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated remotely. The exploit ha...

9CVSS8.9AI score0.00165EPSS

CVE•added 2025/07/22 3:15 a.m.•7 views

CVE-2025-7952

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been d...

8.8CVSS6.9AI score0.04103EPSS

CVE•added 2025/07/25 9:15 p.m.•7 views

CVE-2025-8170

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT Packet Handler. The manipulation of the argument serverIp leads to buffer overflow. The attack can be i...

9CVSS8.8AI score0.00165EPSS

CVE•added 2025/07/21 12:15 a.m.•6 views

CVE-2025-7913

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the argument serverIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has...

9CVSS8.9AI score0.00165EPSS