N200re Firmware
Monthly
Incorrect access control in the web management interface of TOTOLINK A3300R and N200RE router firmware allows remote, unauthenticated attackers to send requests to protected interface endpoints without logging in, granting them high-impact read and write capability over device configuration and data (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Affected builds include A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519, with the practical exposure ceiling set by whether the management interface is reachable from the WAN side. Publicly available exploit code exists (a published proof-of-concept is linked from the NVD entry), but the flaw is not confirmed as actively exploited (no CISA KEV listing) at time of analysis.
Command injection in the TOTOLINK N200RE router firmware (V9.3.5u.6437_B20230519) lets an attacker on the same local network execute arbitrary shell commands on the device through the setOpModeCfg handler's hostName parameter. Because the vector is AV:A with PR:N/UI:N, no credentials or user interaction are needed, but the attacker must already be on the device's Wi-Fi or wired LAN segment (for example a guest, neighbor, or rogue client sharing the broadcast domain) rather than reaching it from the internet. Publicly available exploit code exists (a proof-of-concept PDF is linked from the NVD record), and the flaws were confirmed as command injection per CWE-77; there is no evidence of confirmed in-the-wild exploitation and the vendor has published no fixed firmware in the supplied references.
OS command injection in TOTOLINK N200RE router firmware allows remote authenticated attackers to execute arbitrary commands via the Hostname parameter in the /cgi-bin/cstecgi.cgi endpoint. The vulnerability affects firmware versions 9.3.5u.6095_B20200916 and 9.3.5u.6139_B20201216, and publicly available exploit code exists, though no active exploitation has been confirmed by authorities.
A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical.cgi. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in the web management interface of TOTOLINK A3300R and N200RE router firmware allows remote, unauthenticated attackers to send requests to protected interface endpoints without logging in, granting them high-impact read and write capability over device configuration and data (CVSS 3.1 base 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Affected builds include A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519, with the practical exposure ceiling set by whether the management interface is reachable from the WAN side. Publicly available exploit code exists (a published proof-of-concept is linked from the NVD entry), but the flaw is not confirmed as actively exploited (no CISA KEV listing) at time of analysis.
Command injection in the TOTOLINK N200RE router firmware (V9.3.5u.6437_B20230519) lets an attacker on the same local network execute arbitrary shell commands on the device through the setOpModeCfg handler's hostName parameter. Because the vector is AV:A with PR:N/UI:N, no credentials or user interaction are needed, but the attacker must already be on the device's Wi-Fi or wired LAN segment (for example a guest, neighbor, or rogue client sharing the broadcast domain) rather than reaching it from the internet. Publicly available exploit code exists (a proof-of-concept PDF is linked from the NVD record), and the flaws were confirmed as command injection per CWE-77; there is no evidence of confirmed in-the-wild exploitation and the vendor has published no fixed firmware in the supplied references.
OS command injection in TOTOLINK N200RE router firmware allows remote authenticated attackers to execute arbitrary commands via the Hostname parameter in the /cgi-bin/cstecgi.cgi endpoint. The vulnerability affects firmware versions 9.3.5u.6095_B20200916 and 9.3.5u.6139_B20201216, and publicly available exploit code exists, though no active exploitation has been confirmed by authorities.
A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical.cgi. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in TOTOLINK N200RE 9.3.5u.6255_B20211224. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.