TOTOLINK
Monthly
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 affects the Device-Information CGI handler infostat.cgi, where manipulation of the CONTENT_LENGTH argument in sub_402340 can corrupt stack memory and potentially lead to code execution or denial of service. The issue is remotely reachable, and the supplied CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required when the router's web interface is reachable, although typical SOHO deployments expose management only on the LAN unless remote/web administration has been enabled. A public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present, EPSS is 0.61% (49th percentile), and the vuln.today decision label is act_now.
Command injection in the apmib_set handler of firewall.so on TOTOLINK A950RG routers running firmware 4.1.2cu.5268_B20221104 lets a remote attacker who holds low-privilege credentials execute arbitrary commands on the device, with high impact on confidentiality, integrity and availability. The vulnerable configuration routine is reachable over the network but requires at least low-privilege authentication (PR:L) plus reachability of the management interface, which is typically LAN-side unless remote administration is enabled; no user interaction is involved and attack complexity is low. A public exploit disclosure reference (a GitHub gist) is cited in the advisory and the vendor has not published a fixed firmware build in the available data, while EPSS sits at 1.88% (79th percentile) and priority is rated this_week rather than emergency.
Command injection in the device-information handler of the TOTOLINK A950RG router (firmware 4.1.2cu.5268_B20221104) allows an attacker who can influence the MAC-address value processed by getDeviceInfo to execute arbitrary shell commands on the device. The CVSS vector requires high privileges (PR:H) to reach the vulnerable code path, and the available sources do not specify how a malicious MAC value reaches /var/lib/misc/udhcpd.leases - whether via unauthenticated LAN DHCP traffic or authenticated configuration - so the precise unauthenticated reachability is not confirmed. A public PoC reference exists but is not verified as working exploit code; there is no confirmed active exploitation (no CISA KEV listing), and EPSS is 2.74% (86th percentile), which places it in the upper band of predicted exploitation likelihood and is consistent with the 'this_week' prioritisation label.
Command injection in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers execute shell commands by manipulating the FileMd5 argument handled by UploadCustomModule in lib/cste_modules/product.so. The supplied CVSS 4.0 vector scores it as unauthenticated network exploitation with no user interaction, though practical reachability depends on exposure of the router management service on the LAN, or on the WAN if remote management is enabled. Publicly available exploit code exists, and impact is constrained to this specific model and firmware build.
Stack-based buffer overflow in TOTOLINK EX200 firmware 5.2.3c.7200 allows remote attackers to overflow a stack buffer by sending an oversized macAddress argument to the setWiFiAclAddConfig function in /cgi-bin/cstecgi.cgi (wireless.so), with high confidentiality, integrity, and availability impact per the supplied CVSS vectors. Publicly available exploit code exists, and while the CVSS vector lists PR:N (unauthenticated), authentication requirements are not confirmed from the available data; practical exploitation is normally limited to attackers who can reach the device's LAN/Wi-Fi management interface unless that UI is deliberately WAN-exposed.
Stack-based buffer overflow in the TOTOLINK EX200 Wi-Fi range extender (firmware 5.2.3c.7200) lets remote, unauthenticated attackers crash or potentially execute code on the device by sending a crafted HTTP request to the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi with an oversized Comment parameter. Publicly available exploit code exists (a GitHub proof-of-concept write-up is linked from the VulDB record), and the CVSS 4.0 base score of 9.3 reflects full confidentiality, integrity and availability impact with PR:N/UI:N/AC:L - no credentials or user interaction required. The practical constraint is reachability: the flaw is only exploitable if the extender's web management interface is exposed to the attacker, so the real-world risk is highest on devices whose administrative UI is reachable from the WAN or from an untrusted network segment rather than the typical isolated LAN-side deployment.
Authenticated command injection in TOTOLINK X2000R is a serious but privilege-gated flaw: an attacker who already holds administrative access to the router's web management interface can send a crafted HTTP request to the Boa formWsc handler and execute arbitrary OS commands via the peerRptPin parameter. The affected build is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, and exploitation requires high privileges (PR:H) but no user interaction and low attack complexity once admin access is obtained. No public exploit was identified at time of analysis, and the practical barrier is credential acquisition, such as weak, default, or reused admin passwords or a chained authentication bypass.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an administrator-level attacker to execute arbitrary shell commands by sending a crafted HTTP request to the boa formWsc handler with a malicious targetAPSsid value. The issue is rated CVSS 9.1 and requires a valid high-privileged administrative session (PR:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk depends heavily on whether the router management interface is exposed.
Authenticated remote code execution is possible in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa formMapDelDevice hostname handling. An attacker must already hold administrative credentials on the device's web management interface and send a crafted HTTP request with an oversized hostname value; no public exploit code was identified at time of analysis. The published CVSS 9.1 uses a changed-scope (S:C) vector, while our independent assessment treats scope as unchanged (S:U) and stresses that practical risk is conditional on exposed management access and unchanged/default admin credentials.
Stack-based buffer overflow in the boa HTTP management interface of TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an authenticated administrator to trigger memory corruption via an overlong 'macstr' parameter to formMapDelDevice, potentially achieving arbitrary code execution. The flaw is network-reachable and low-complexity but requires valid high-privilege credentials (CVSS PR:H), so it is not an unauthenticated remote takeover despite the 9.1 base score. No public exploit code or active exploitation is identified in the provided data; exposure is highest where the management interface is reachable from untrusted networks such as WAN/remote management.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows a high-privileged administrative user to execute arbitrary OS commands by sending a crafted HTTP request to the boa formMapDelDevice handler with shell metacharacters in the macstr parameter (CVSS 9.1). Exploitation requires a valid administrative session and network reachability to the management interface, typically LAN-side unless WAN management is enabled; no public exploit code was identified at time of analysis.
Stack-based buffer overflow in the boa web server's formParentControl url handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a crafted HTTP request that can corrupt stack memory and potentially achieve arbitrary code execution. The source advisory rates it CVSS 3.1 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), while independent assessment treats the prerequisite as authenticated access (PR:L) with unchanged scope; the main exposure driver is internet-reachable router management with valid or weak/default credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a user holding administrator credentials on the boa web management interface to send a crafted HTTP request to the formParentControl handler with an oversized 'deviceName' parameter and achieve arbitrary code execution on the device. Talos rates the issue 9.1, while our reassessment keeps the high confidentiality/integrity/availability impact but scores scope as unchanged (S:U) rather than changed; the dominant limiting factor is PR:H, so real-world risk concentrates on routers reachable from the WAN with default or reused admin passwords or where an authentication bypass can be chained. No public exploit code was identified at the time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa web management interface allows an attacker with admin-level credentials to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup PPPoE handler, specifically through an oversized pppoe_dns2 parameter. The vulnerability affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and is gated by PR:H, so it is not an unauthenticated remote takeover; exposure is materially lower when the web UI is not reachable from the WAN. No public exploit code or confirmed active exploitation was identified at time of analysis, though the published CVSS score is 9.1 and the assessed vector confirms high confidentiality, integrity, and availability impact.
Arbitrary code execution in TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) is possible through a stack-based buffer overflow in the boa web server's formIpv6Setup PPPoE handler when the pppoe_dns1 parameter receives an overlong value. The attack requires an authenticated HTTP request with valid management credentials (CVSS PR:H) and network reachability to the router's management interface, which is typically LAN-side. No public exploit was identified at time of analysis; Talos rates the issue 9.1 critical under a scope-changed vector, while the independent assessment scopes the impact to the device (S:U) and still considers it high severity.
Authenticated administrator-level attackers can achieve arbitrary code execution on Totolink X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 by sending a crafted HTTP request with an overlong static_gw parameter to the boa formIpv6Setup static network configuration endpoint. The stack-based buffer overflow (CWE-121) requires a valid admin session (CVSS PR:H), so exposure of the web management interface and weak or default credential hygiene are the practical enablers. This is a high-severity issue, but no public exploit was identified at time of analysis, and other firmware or hardware revisions are not confirmed affected from the available data.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where an oversized static_ipv6 parameter sent to the boa formIpv6Setup handler overflows a stack buffer and can lead to arbitrary code execution. Exploitation requires valid administrative credentials on the router's web management interface (CVSS PR:H), which is typically reachable only from the LAN unless remote administration is enabled; default or weak admin passwords on consumer routers reduce that barrier. No public exploit code was identified at time of analysis.
Stack-based buffer overflow in the boa web server of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding valid administrative credentials to achieve arbitrary code execution by sending a crafted HTTP request that oversizes the static_dns2 parameter to the formIpv6Setup handler. The flaw carries a CVSS 3.1 base score of 9.1, but exploitation is gated by PR:H - the attacker must first authenticate to the web management interface and have network reachability to it, so unauthenticated or internet-wide mass exploitation is not indicated by the available data. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released patch has been identified; risk is concentrated on devices whose administrative interface is WAN-exposed or protected by default or weak credentials.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa HTTP server's formIpv6Setup handler. An attacker who already holds administrative credentials can send a crafted HTTP request with an oversized static_dns1 parameter to corrupt stack memory and potentially execute arbitrary code. The flaw is rated CVSS 9.1 but requires high-privilege access to the management interface; no public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Stack-based buffer overflow in the TOTOLINK X2000R router's boa web management server allows an authenticated administrator to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup endpoint carrying an oversized dhcp_dns2 parameter. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed affected, and the attack requires a valid high-privilege session (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N) on the device's web interface, meaning real-world exploitation generally depends on default-credential reuse or chaining with a separate authentication bypass. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released fix is confirmed in the available data.
Arbitrary code execution in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) requires an attacker to first authenticate to the boa administrative web interface, then send a crafted HTTP request whose dhcp_dns1 parameter overflows a fixed-size stack buffer in the formIpv6Setup handler. Successful exploitation corrupts stack memory and can redirect execution to attacker-controlled data, giving code execution on the device with the web server's privileges. The CVSS vector (PR:H) and the Talos report both confirm that valid high-privilege admin credentials are a hard prerequisite, so the practical threat is concentrated on devices whose management interface is exposed to untrusted networks or left on default/weak credentials; no public exploit code or active exploitation was identified at time of analysis.
Stack-based buffer overflow in TOTOLINK X2000R router firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a high-privileged authenticated management user to trigger arbitrary code execution by sending a crafted HTTP request to the boa formFilter endpoint with an oversized vpnPassword parameter. The CVSS vector confirms network reachability, low attack complexity, high privileges required, and no user interaction; risk is concentrated on devices with exposed web administration and weak or default admin credentials. No public exploit was identified at time of analysis.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where the boa web management interface's formFilter handler processes the vpnUser HTTP parameter into a fixed-size stack buffer without adequate bounds checking. An attacker who first obtains administrative credentials (PR:H) can send an oversized vpnUser value to overflow the stack and potentially execute arbitrary code; exposure is limited by the need for valid admin authentication and reachability of the management interface. The authoritative assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis.
Authenticated OS command injection in the TOTOLINK X2000R boa web interface lets an attacker with administrative access execute arbitrary code on the router through the formWizard newPass setup-wizard handler. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and carries a published CVSS score of 9.1; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact but unchanged scope. Exploitation requires a valid admin session (PR:H), and no CISA KEV listing, public exploit code, or active exploitation was identified at time of analysis.
Authenticated stack-based buffer overflow in the boa formUploadFile handler on TOTOLINK X2000R routers can allow arbitrary code execution when a specially crafted HTTP request is sent to the web management interface. The issue affects the specific firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires administrative credentials (PR:H) plus network reachability to the management UI, which is normally LAN-restricted. No public exploit has been identified at time of analysis, and the vendor/Talos CVSS is 9.1.
Authenticated path traversal in the boa formUploadFile handler of TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an attacker with valid web-management credentials to write arbitrary files and potentially achieve code execution. The issue is high severity but gated by mandatory authentication to the router's HTTP administration interface, so realistic risk is concentrated on devices with exposed admin access or weak/default credentials. No public exploit was identified at time of analysis, and no CISA KEV active-exploitation confirmation is available.
Stack-based buffer overflow in the boa web server's formTR069Config handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a specially crafted HTTP request that overflows a fixed-size stack buffer and can lead to arbitrary code execution on the router. The flaw is network-reachable with low attack complexity, but exploitation requires valid management credentials (CVSS PR:H), making exposure of the administrative interface and credential hygiene the decisive risk factors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 9.1 CRITICAL base score reflects full confidentiality, integrity and availability impact once the authentication barrier is crossed.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router allows anyone holding administrative credentials to run arbitrary commands on the device by sending a crafted HTTP request to the formPasswordSetup endpoint. Only units running firmware V1.0.0-B20250421.1327 are affected, and the CVSS vector (PR:H) confirms the flaw sits behind a high-privileged login, so it is an access-gated post-authentication escalation to full device compromise rather than a pre-auth router takeover. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; the real-world risk comes from internet-exposed management interfaces and from default or reused admin passwords.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa formIpQos handler lets an attacker with administrator credentials send a crafted HTTP request containing a malicious 'mac' parameter to overwrite a stack buffer and achieve arbitrary code execution. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires a valid high-privilege management session plus reachability of the boa web interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and practical risk is concentrated where default or weak admin credentials and WAN-exposed management interfaces are present.
Authenticated administrative users of TOTOLINK X2000R firmware build B20250421.1327 can trigger a stack-based buffer overflow through crafted HTTP requests to the batchupg endpoint, potentially achieving arbitrary code execution. The CVSS vector requires high privileges (PR:H), meaning valid admin credentials are the primary prerequisite, and reachability depends on the management interface being accessible to the attacker. No public exploit code was identified at time of analysis, and no pre-authentication exploitation path is indicated.
OS command injection in the batchupg (batch upgrade) handler of TOTOLINK X2000R firmware build V1.0.0-B20250421.1327 lets an attacker who already holds a valid administrator session on the router's web management interface send a crafted HTTP request that executes arbitrary shell commands on the device, yielding a full compromise of confidentiality, integrity, and availability. The prerequisite of high-privileged web credentials (CVSS PR:H) sharply limits exposure - this is not reachable by an unauthenticated attacker - but the practical risk climbs sharply on units whose admin panel is exposed to the WAN or still uses default/weak credentials. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the flaw was reported by Cisco Talos under TALOS-2026-2435.
Authenticated attackers can trigger a heap-based buffer overflow in the boa web server's formUpload() handler on TOTOLINK X2000R routers running firmware V1.0.0-B20250421.1327, potentially leading to arbitrary code execution. The vulnerability requires valid administrative credentials (PR:H) but no user interaction, and the management interface must be network-reachable. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated attackers who can reach the boa web administration interface on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 can trigger a stack-based buffer overflow by sending a crafted HTTP request to formUpload(), with potential for arbitrary code execution and high confidentiality, integrity, and availability impact. The issue is access-gated: exploitation requires high-privilege router administrator credentials (PR:H) and low complexity once authenticated (AC:L/UI:N), so realistic risk depends on whether the management UI is exposed and protected by default or weak credentials. No public exploit code or CISA KEV active-exploitation listing was identified in the provided data.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding a valid administrative session to send a crafted HTTP request to the formUpload() handler and have unsanitized input executed as a shell command, yielding arbitrary code execution on the device. Reported by Cisco Talos (TALOS-2026-2438) with a high severity score; exploitation requires PR:H admin privileges and network reachability to the management HTTP interface, so exposure is greatest where the admin UI is reachable from the WAN or default/weak credentials are in use. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor-released fix version is referenced in the available data.
A stack-based buffer overflow in the Mcli handler of the TOTOLINK X2000R router's web management interface lets an attacker who supplies a specially crafted HTTP request overwrite stack memory and potentially achieve arbitrary code execution on the device. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 has been confirmed affected, and exploitation requires valid administrative credentials (PR:H in the CVSS vector), so the practical attack path is an authenticated one against an exposed management interface. Vendor severity is rated 9.1 and the flaw was reported by Cisco Talos as TALOS-2026-2439; no public exploit code or confirmed active exploitation was identified at time of analysis, though risk rises sharply on deployments where the admin UI is reachable from the WAN or protected by default/reused credentials.
Unsigned firmware images are accepted and flashed by the boa-based firmware update handler on TOTOLINK X2000R routers running build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, allowing an attacker who already holds administrative web-interface credentials to install arbitrary firmware. The flaw is an improper verification of cryptographic signature (CWE-347): the device performs no meaningful code-signing check on the uploaded image, so a crafted binary can yield persistent, privileged control of the router. Talos rates it CVSS 3.1 base 9.1, though the practical barrier is the PR:H administrative prerequisite; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
OS command injection in the TOTOLINK X6000R wireless router (firmware 9.4.0cu.652_B20230116) allows remote attackers to execute arbitrary shell commands on the device by supplying a crafted file_name argument that is processed by the firmware_check routine behind the /cgi-bin/cstecgi.cgi endpoint. The vendor-derived CVSS 4.0 vector scores this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems), and our independent assessment is consistent: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating low-complexity, unauthenticated remote exploitation with scope change and full device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and real-world exposure is limited to units whose web management interface is reachable from the attacker's position - a WAN-exposed admin interface or an attacker already positioned on the LAN.
Stack-based buffer overflow in the TOTOLINK A3002MU router's QoS Rule Handler allows remote attackers to corrupt memory on the device by supplying oversized addQos, comment, or entry_name arguments to /boafrm/formIpQoS, with high confidentiality, integrity, and availability impact. Only firmware 1.0.0-B20230403.1455 is identified as affected, and publicly available exploit code exists (a published proof-of-concept gist), so anyone who can reach the management interface can attempt it. The published CVSS 4.0 vector scores 9.3 as network-reachable, low-complexity, and unauthenticated (PR:N/UI:N); note however that TOTOLINK /boafrm/ handlers commonly require an authenticated web session, so the realistic risk is concentrated where the admin interface is exposed to the WAN or reachable from an untrusted LAN segment.
Improper authorization in the boa web server on TOTOLINK A3002MU firmware 1.0.0-B20230403.1455 lets remote, unauthenticated attackers reach protected administrative functionality without a valid session, giving them full control over the device's web management interface (high confidentiality, integrity and availability impact). Publicly available exploit code exists against the authentication-check function sub_40FCFC in /bin/boa, so weaponisation effort is low, although no CISA KEV listing or other confirmation of active exploitation was present in the available intelligence at time of analysis. Exposure is the practical limiter: units with WAN-side management enabled are directly internet-exploitable, whereas units whose admin interface is LAN-only require an on-network attacker or a LAN-side pivot.
Authenticated stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface (firmware V3.4.0-B20201030) allows a network-adjacent or remote attacker holding low-privilege credentials to crash or seize control of the device by posting an oversized ApCliWEPKey value to the /boafrm/formAjaxSet handler on the topicurl=setting/setWiFiRepeaterConfig branch. Successful exploitation yields total loss of confidentiality, integrity and availability on the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which in a home or small-office context means credential interception, DNS/traffic manipulation, and use of the device as a pivot. No public exploit has been identified at time of analysis, CISA SSVC records exploitation as 'none', and no vendor-released patch or fixed firmware version has been identified; exposure is largely gated by whether the administration interface is reachable (LAN-bound by default, internet-reachable only when remote management is enabled).
Stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface, firmware V3.4.0-B20201030, allows a remote attacker to corrupt memory and potentially gain code execution by sending oversized ip_subnet and fw_ip parameters to the /boafrm/formPortFw port-forwarding handler during the rule-addition flow. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), modeling an unauthenticated, low-complexity attack with full confidentiality, integrity and availability impact, although port-forwarding configuration is normally an admin-authenticated function and the PR:N assertion should be confirmed against the published proof-of-concept material before relying on it. No CISA KEV entry or confirmed public exploit was identified at time of analysis, and realistic exposure is primarily LAN-side unless the management interface has been deliberately exposed to the WAN or internet.
TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 contains a stack-based buffer overflow in the web management handler /boafrm/formFilter that is triggered when an oversized url parameter is submitted with the addFilterUrl (or addFilterUrlFlag) action flag set, allowing an attacker who can reach the interface to corrupt stack memory and gain full control of the device (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Exploitation is network-reachable and low-complexity but requires low-privilege authenticated access, so the realistic exposure is limited to management interfaces reachable on the LAN or to deployments where WAN-side remote administration has been enabled. No public exploit identified at time of analysis, no CISA KEV entry is present, and SSVC records Exploitation: none with Technical Impact: total; a third-party gist reference is linked but is not confirmed as weaponized exploit code.
OS command injection in the TOTOLINK N150RT SOHO router (firmware 3.4.0-B20201030) lets an attacker who can reach the Web Management Interface and has at least low-privilege credentials execute arbitrary operating-system commands on the device. The flaw is reachable through the /boafrm/formWlSiteSurvey handler, where the 'wlanif' argument is passed unsanitized into a shell command, giving full compromise of confidentiality, integrity and availability (CVSS 4.0 base 8.6; independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a reference gist is tagged as an exploit), meaning the technique is already in circulation, but the issue is not confirmed actively exploited (no CISA KEV entry) and it is privilege-gated: the router web interface is normally LAN-facing, so WAN reachability depends on remote administration being enabled.
OS command injection in the Totolink A3002MU router firmware (build Hh-B20211125.1046) lets a remote attacker who holds valid low-privilege credentials execute arbitrary shell commands on the device through the formWsc handler in /boafrm/formWsc by supplying a crafted localPin argument. Because the affected component is the router's BOA web management service, successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 4.0 score 8.6, PR:L, no user interaction), and on consumer routers the required low-privilege session is often trivially satisfied by unchanged default administrative credentials. Publicly available exploit code exists (a published proof-of-concept walkthrough for the A3002MU rce-formWsc path), and although there is no confirmation of active exploitation in CISA KEV, the combination of a public PoC, a network-reachable attack surface and low complexity makes this a high-priority patching target for internet- or LAN-exposed devices.
A stack-based buffer overflow in the TOTOLINK A3002MU wireless router (firmware Hh-B20211125.1046) allows remote attackers to corrupt memory through the 'submit-url' argument handled by the formWlWds function at /boafrm/formWlWds, with the CVSS 4.0 vector scoring 9.3 and indicating no authentication or user interaction prerequisite (PR:N/UI:N), though the independent assessment notes the endpoint's pre-authentication status is not explicitly confirmed by the description. Impact is potentially full compromise of confidentiality, integrity, and availability on the device, but practical success depends on network reachability to the Boa web management interface, the specific firmware build, and the difficulty of converting an embedded-MIPS stack overflow into reliable code execution rather than a simple crash. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Buffer overflow in the TOTOLINK A3002MU router (firmware Hh-B20211125.1046) lets remote attackers corrupt memory by sending a crafted submit-url value to the /boafrm/formWlEncrypt endpoint, with the vendor's CVSS 4.0 vector rated 9.3 and full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The CVSS 4.0 vector specifies PR:N and UI:N, meaning the attack is unauthenticated and requires no user interaction, and publicly available exploit code exists, though no confirmed active exploitation has been reported (no CISA KEV listing). The dominant practical gating factor is exposure of the device's boa-based HTTP management interface, which on most SOHO deployments is reachable only from the LAN, narrowing the threat to local or adjacent-network attackers unless remote administration is enabled.
A buffer overflow in TOTOLINK A3002MU routers running firmware Hh-B20211125.1046 lets an authenticated remote attacker corrupt memory by sending an oversized submit-url value to the formWlAc handler at /boafrm/formWlAc, potentially gaining full control over the device's confidentiality, integrity and availability. Publicly available exploit code exists - a proof-of-concept write-up is published on GitHub and the flaw is documented by VulDB - but there is no evidence of confirmed active exploitation (CISA KEV). Multiple signals align to a moderate-to-high real-world risk, with the practical prerequisite being valid credentials or an active admin session and a management interface reachable from the attacker's network.
Authenticated buffer overflow in the web management interface of the TOTOLINK A3002MU router (firmware build Hh-B20211125.1046) lets an attacker who already holds a valid management session corrupt memory via an oversized 'webpage' argument submitted to /boafrm/formSchedule, with the potential for code execution and full loss of confidentiality, integrity, and availability. The reporting source rates it 8.6 (CVSS 4.0), and publicly available exploit code exists, but there is no confirmed active exploitation and the flaw is not in CISA KEV. In practice this is a genuine but moderate-priority issue: the CVSS vector's PR:L and the device's normally LAN-only management plane mean the attacker needs authenticated access reachable to the router's admin interface, so risk rises sharply only where remote/WAN administration or default credentials are exposed.
Hardcoded root credentials in TOTOLINK X5000R firmware V9.1.0cu.2415_B20250515 allow unauthenticated remote attackers to gain full administrative control, leading to complete compromise of confidentiality, integrity, and availability. The issue requires network reachability to an authentication service (such as Telnet, SSH, or the web management interface) that accepts the static credential, which is a trivial condition once that service is exposed; however, on typical SOHO deployments the management interface is bound to the LAN, so internet-based exploitation necessitates WAN exposure of the admin service. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the EPSS score is low (0.19%, 9th percentile).
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
Buffer overflow in TOTOLINK CP450 4.1.0's web CGI handler allows low-privileged remote attackers to corrupt memory and likely execute arbitrary code by supplying an oversized value to the `topicurl` argument in `/cgi-bin/cstecgi.cgi`. The CVSS 4.0 threat metric E:P confirms proof-of-concept exploit code exists, elevating this beyond a theoretical concern. No vendor patch or advisory has been published, leaving affected devices exposed with only compensating controls available.
Unauthenticated state tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite the mesh slave-IP inventory by publishing a crafted MQTT message to the cs_broker component, which performs no access control on the updateSlaveIpList function. Any attacker able to reach the MQTT broker can corrupt the router's internal record of mesh slave device addresses, disrupting mesh coordination. No public exploit has been identified and EPSS is low (0.17%), but the flaw is unauthenticated and MITRE-reported.
Incorrect access control in the recvIndirectMeshInfo function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers insert or replace mesh neighbor records by sending a crafted MQTT message to the cs_broker component. The CVSS 9.8 rating reflects an unauthenticated network-facing vector, but the primary real impact is integrity (poisoning of the mesh neighbor table), with no confidentiality read and only indirect availability effect. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile).
Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch.
Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete MAC address filter rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delMacFilterRules function. Because no authentication is required, an attacker on the network path can silently strip a device-access control layer, potentially allowing previously blocked/rogue devices onto the LAN. No public exploit identified at time of analysis, and the EPSS score is very low (0.16%, 6th percentile) despite the headline 9.8 CVSS.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive.
Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.
Memory corruption in TOTOLINK A720R router firmware 4.1.5cu.630_B20250509 allows authenticated remote attackers to trigger a buffer overflow in the MAC filtering subsystem, with potential for arbitrary code execution. The vulnerable path is the `setMacFilterRules` function within `cstecgi.cgi`, exploitable by sending a crafted `desc` argument over the network. A public proof-of-concept is available on GitHub; no CISA KEV listing exists at time of analysis, but the combination of network reachability and published exploit code meaningfully elevates real-world risk.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected client MAC addresses to any remote attacker via the getStationMacByIp CGI function. The /cgi-bin/cstecgi.cgi endpoint processes crafted POST requests without enforcing any access control, returning MAC address data that can enable network reconnaissance and bypass of MAC-based access filtering. No confirmed active exploitation or CISA KEV listing exists, and EPSS probability is negligible at 0.18%, though the fully unauthenticated network vector makes automated scanning trivial.
Unauthenticated network topology and interface configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with access to the device's web management interface to retrieve sensitive network layout data without credentials. The getNetInfoCfg function in /cgi-bin/cstecgi.cgi enforces no access control, so a single crafted POST request returns interface and topology details that support downstream reconnaissance and targeted follow-on attacks. No public exploit code is confirmed and EPSS sits at 0.18% (7th percentile), but SOHO routers are frequently internet-exposed with factory defaults intact, elevating practical risk above what EPSS alone implies.
Unauthenticated online client enumeration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected device information to any attacker who can reach the router's HTTP management interface. The getOnlineClient function within the /cgi-bin/cstecgi.cgi CGI dispatcher applies no access control, so a crafted POST request returns the router's live client inventory without credentials. No public exploit has been identified at time of analysis and the EPSS score sits at 0.18% (7th percentile), indicating this is not being exploited at scale - consistent with a batch of researcher-coordinated disclosures across multiple T6 CGI endpoints rather than active threat actor campaigns.
Unauthenticated IPTV and IGMP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve multicast group settings, IPTV server parameters, and IGMP proxy configuration without credentials. The getIptvCfg function in the router's CGI web interface fails to enforce access control, accepting a crafted POST to /cgi-bin/cstecgi.cgi and returning configuration data to unauthenticated callers. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) indicates minimal current exploitation interest.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh routing table data through the getMeshRoutingTable CGI function. An attacker with network access to the device can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve internal mesh routing topology without any credentials. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.18%, though GitHub-hosted CVE coordination repositories suggest researcher awareness and POC development activity.
Unauthenticated access to the getWiFiMeshConfig endpoint on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh network configuration and runtime state to any attacker reachable over the management interface. The CGI handler at /cgi-bin/cstecgi.cgi fails to enforce authentication before executing getWiFiMeshConfig, returning sensitive mesh topology data in response to a single crafted POST request with no credentials. No public exploit or active exploitation has been identified; EPSS at 0.18% (7th percentile) and SSVC exploitation=none confirm low observed exploitation pressure despite the SSVC automatable=yes rating.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud remote-control (CRPC) status and management URL through the getCrpcCfg function. The /cgi-bin/cstecgi.cgi endpoint processes POST requests without enforcing access control, allowing any network-adjacent attacker to enumerate whether cloud remote management is active and retrieve its target URL. No public exploit has been identified at time of analysis and EPSS sits at the 7th percentile, indicating low current exploitation pressure despite the trivially simple attack vector.
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in the Totolink NR1800X router (firmware 9.1.0u.6279_B20210910) lets remote attackers corrupt memory by supplying an oversized HTTP Host header to the Form_Logout handler at /formLogout.htm, served by the embedded lighttpd web interface. Because the flaw is reachable over the network without authentication and publicly available exploit code exists, it is a strong candidate for opportunistic exploitation despite not yet appearing in CISA KEV. Successful exploitation can crash the device or, given the CWE-121 stack overwrite, potentially achieve code execution on the router.
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200 through firmware 20260906) stems from the /etc/boa/boa.conf configuration of the Boa web-server interface, allowing a low-privileged remote actor to gain access or information beyond their intended authorization boundary. The flaw carries CVSS 4.0 base score 7.7 with high attack complexity, and VulDB rates real-world exploitation as difficult. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Totolink EX1200L router's login handler (cgi-bin/cstecgi.cgi) allows remote attackers on the adjacent network to crash the device or execute arbitrary code as root. Confirmed on firmware 9.3.5u.6146_B20201023 with no public exploit identified at time of analysis, but vendor contact attempts by CERT-PL were unsuccessful so no patch is available. CVSS 4.0 of 9.4 reflects unauthenticated exploitation with full impact on both the device and downstream systems.
Stack-based buffer overflow in the Totolink N300RH router (firmware 6.1c.1353_B20190305) allows remote attackers to corrupt memory via the KeyStr argument processed by the setWiFiBasicConfig function in wireless.so, reachable through the Web Management Interface. Publicly available exploit code exists, and the CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. No CISA KEV listing has been published, so exploitation is not confirmed in the wild despite the public PoC.
OS command injection in the Totolink N300RH router (firmware 6.1c.1353_B20190305) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the admpass argument sent to the setPasswordCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the SSVC framework rates technical impact as total with automatable exploitation, though EPSS remains low at 0.20%. The flaw is reachable over the network without authentication or user interaction, giving an attacker full control of the device.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands via the 'enable' parameter of the setParentalRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and while the EPSS score of 0.89% (76th percentile) suggests moderate predicted exploitation likelihood, the network-accessible attack surface on an edge device elevates real-world risk significantly.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'mac' parameter sent to the setAccessDeviceCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and SSVC rates the technical impact as total with automatable exploitation, though EPSS remains modest at 0.89% (76th percentile). No CISA KEV listing has been published at time of analysis.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the admpass parameter sent to the setPasswordCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the flaw is reachable over the network without user interaction, though no public exploit identified at time of analysis indicates active in-the-wild abuse via CISA KEV.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated remote attackers to execute arbitrary operating system commands via the Comment parameter handled by the setIpQosRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the SSVC framework rates the technical impact as total with automatable exploitation, though no public exploit identified at time of analysis as actively exploited in the CISA KEV catalog. EPSS sits at 0.89% (76th percentile), suggesting moderate but non-trivial exploitation interest.
Remote OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated attackers to execute arbitrary operating system commands through the setWanCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' parameter. Publicly available exploit code exists, and with CVSS 4.0 score of 8.9 (network-reachable, low complexity, no privileges required), exposed devices face high risk despite an EPSS score of 0.89% (76th percentile) indicating moderate near-term exploitation probability.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the FileName argument in the UploadFirmwareFile function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB reporting, and SSVC rates this as automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile) indicating no broad mass-exploitation campaign yet observed.
Remote OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary commands via the setOpenVpnCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' argument. Publicly available exploit code exists, raising the risk of opportunistic attacks against exposed devices, though EPSS scoring (0.89%, 76th percentile) suggests moderate but not yet widespread exploitation. The flaw stems from improper neutralization of OS command elements (CWE-78) in the router's Web Management Interface.
OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the FileName parameter in the UploadOpenVpnCert function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB disclosure, and SSVC scoring indicates the flaw is automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile). The vulnerability is no public exploit identified in CISA KEV, but POC availability combined with network-reachable management interface elevates real-world risk.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary commands via the servername parameter of the setOpenVpnCertGenerationCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub PoC), and although the EPSS score is modest (0.89%, 76th percentile), the CVSS 4.0 score of 8.9 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No CISA KEV listing has been recorded at the time of analysis.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' argument passed to the setL2tpServerCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published on GitHub), though EPSS probability remains modest at 0.94% (76th percentile), and the issue is not currently listed in CISA KEV.
Stack-based buffer overflow in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 affects the Device-Information CGI handler infostat.cgi, where manipulation of the CONTENT_LENGTH argument in sub_402340 can corrupt stack memory and potentially lead to code execution or denial of service. The issue is remotely reachable, and the supplied CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required when the router's web interface is reachable, although typical SOHO deployments expose management only on the LAN unless remote/web administration has been enabled. A public PoC reference exists but is not verified as working exploit code; no CISA KEV confirmation is present, EPSS is 0.61% (49th percentile), and the vuln.today decision label is act_now.
Command injection in the apmib_set handler of firewall.so on TOTOLINK A950RG routers running firmware 4.1.2cu.5268_B20221104 lets a remote attacker who holds low-privilege credentials execute arbitrary commands on the device, with high impact on confidentiality, integrity and availability. The vulnerable configuration routine is reachable over the network but requires at least low-privilege authentication (PR:L) plus reachability of the management interface, which is typically LAN-side unless remote administration is enabled; no user interaction is involved and attack complexity is low. A public exploit disclosure reference (a GitHub gist) is cited in the advisory and the vendor has not published a fixed firmware build in the available data, while EPSS sits at 1.88% (79th percentile) and priority is rated this_week rather than emergency.
Command injection in the device-information handler of the TOTOLINK A950RG router (firmware 4.1.2cu.5268_B20221104) allows an attacker who can influence the MAC-address value processed by getDeviceInfo to execute arbitrary shell commands on the device. The CVSS vector requires high privileges (PR:H) to reach the vulnerable code path, and the available sources do not specify how a malicious MAC value reaches /var/lib/misc/udhcpd.leases - whether via unauthenticated LAN DHCP traffic or authenticated configuration - so the precise unauthenticated reachability is not confirmed. A public PoC reference exists but is not verified as working exploit code; there is no confirmed active exploitation (no CISA KEV listing), and EPSS is 2.74% (86th percentile), which places it in the upper band of predicted exploitation likelihood and is consistent with the 'this_week' prioritisation label.
Command injection in TOTOLINK A950RG firmware 4.1.2cu.5268_B20221104 lets remote attackers execute shell commands by manipulating the FileMd5 argument handled by UploadCustomModule in lib/cste_modules/product.so. The supplied CVSS 4.0 vector scores it as unauthenticated network exploitation with no user interaction, though practical reachability depends on exposure of the router management service on the LAN, or on the WAN if remote management is enabled. Publicly available exploit code exists, and impact is constrained to this specific model and firmware build.
Stack-based buffer overflow in TOTOLINK EX200 firmware 5.2.3c.7200 allows remote attackers to overflow a stack buffer by sending an oversized macAddress argument to the setWiFiAclAddConfig function in /cgi-bin/cstecgi.cgi (wireless.so), with high confidentiality, integrity, and availability impact per the supplied CVSS vectors. Publicly available exploit code exists, and while the CVSS vector lists PR:N (unauthenticated), authentication requirements are not confirmed from the available data; practical exploitation is normally limited to attackers who can reach the device's LAN/Wi-Fi management interface unless that UI is deliberately WAN-exposed.
Stack-based buffer overflow in the TOTOLINK EX200 Wi-Fi range extender (firmware 5.2.3c.7200) lets remote, unauthenticated attackers crash or potentially execute code on the device by sending a crafted HTTP request to the setStaticDhcpConfig function in /cgi-bin/cstecgi.cgi with an oversized Comment parameter. Publicly available exploit code exists (a GitHub proof-of-concept write-up is linked from the VulDB record), and the CVSS 4.0 base score of 9.3 reflects full confidentiality, integrity and availability impact with PR:N/UI:N/AC:L - no credentials or user interaction required. The practical constraint is reachability: the flaw is only exploitable if the extender's web management interface is exposed to the attacker, so the real-world risk is highest on devices whose administrative UI is reachable from the WAN or from an untrusted network segment rather than the typical isolated LAN-side deployment.
Authenticated command injection in TOTOLINK X2000R is a serious but privilege-gated flaw: an attacker who already holds administrative access to the router's web management interface can send a crafted HTTP request to the Boa formWsc handler and execute arbitrary OS commands via the peerRptPin parameter. The affected build is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, and exploitation requires high privileges (PR:H) but no user interaction and low attack complexity once admin access is obtained. No public exploit was identified at time of analysis, and the practical barrier is credential acquisition, such as weak, default, or reused admin passwords or a chained authentication bypass.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an administrator-level attacker to execute arbitrary shell commands by sending a crafted HTTP request to the boa formWsc handler with a malicious targetAPSsid value. The issue is rated CVSS 9.1 and requires a valid high-privileged administrative session (PR:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk depends heavily on whether the router management interface is exposed.
Authenticated remote code execution is possible in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa formMapDelDevice hostname handling. An attacker must already hold administrative credentials on the device's web management interface and send a crafted HTTP request with an oversized hostname value; no public exploit code was identified at time of analysis. The published CVSS 9.1 uses a changed-scope (S:C) vector, while our independent assessment treats scope as unchanged (S:U) and stresses that practical risk is conditional on exposed management access and unchanged/default admin credentials.
Stack-based buffer overflow in the boa HTTP management interface of TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an authenticated administrator to trigger memory corruption via an overlong 'macstr' parameter to formMapDelDevice, potentially achieving arbitrary code execution. The flaw is network-reachable and low-complexity but requires valid high-privilege credentials (CVSS PR:H), so it is not an unauthenticated remote takeover despite the 9.1 base score. No public exploit code or active exploitation is identified in the provided data; exposure is highest where the management interface is reachable from untrusted networks such as WAN/remote management.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows a high-privileged administrative user to execute arbitrary OS commands by sending a crafted HTTP request to the boa formMapDelDevice handler with shell metacharacters in the macstr parameter (CVSS 9.1). Exploitation requires a valid administrative session and network reachability to the management interface, typically LAN-side unless WAN management is enabled; no public exploit code was identified at time of analysis.
Stack-based buffer overflow in the boa web server's formParentControl url handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a crafted HTTP request that can corrupt stack memory and potentially achieve arbitrary code execution. The source advisory rates it CVSS 3.1 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), while independent assessment treats the prerequisite as authenticated access (PR:L) with unchanged scope; the main exposure driver is internet-reachable router management with valid or weak/default credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a user holding administrator credentials on the boa web management interface to send a crafted HTTP request to the formParentControl handler with an oversized 'deviceName' parameter and achieve arbitrary code execution on the device. Talos rates the issue 9.1, while our reassessment keeps the high confidentiality/integrity/availability impact but scores scope as unchanged (S:U) rather than changed; the dominant limiting factor is PR:H, so real-world risk concentrates on routers reachable from the WAN with default or reused admin passwords or where an authentication bypass can be chained. No public exploit code was identified at the time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa web management interface allows an attacker with admin-level credentials to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup PPPoE handler, specifically through an oversized pppoe_dns2 parameter. The vulnerability affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and is gated by PR:H, so it is not an unauthenticated remote takeover; exposure is materially lower when the web UI is not reachable from the WAN. No public exploit code or confirmed active exploitation was identified at time of analysis, though the published CVSS score is 9.1 and the assessed vector confirms high confidentiality, integrity, and availability impact.
Arbitrary code execution in TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) is possible through a stack-based buffer overflow in the boa web server's formIpv6Setup PPPoE handler when the pppoe_dns1 parameter receives an overlong value. The attack requires an authenticated HTTP request with valid management credentials (CVSS PR:H) and network reachability to the router's management interface, which is typically LAN-side. No public exploit was identified at time of analysis; Talos rates the issue 9.1 critical under a scope-changed vector, while the independent assessment scopes the impact to the device (S:U) and still considers it high severity.
Authenticated administrator-level attackers can achieve arbitrary code execution on Totolink X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 by sending a crafted HTTP request with an overlong static_gw parameter to the boa formIpv6Setup static network configuration endpoint. The stack-based buffer overflow (CWE-121) requires a valid admin session (CVSS PR:H), so exposure of the web management interface and weak or default credential hygiene are the practical enablers. This is a high-severity issue, but no public exploit was identified at time of analysis, and other firmware or hardware revisions are not confirmed affected from the available data.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where an oversized static_ipv6 parameter sent to the boa formIpv6Setup handler overflows a stack buffer and can lead to arbitrary code execution. Exploitation requires valid administrative credentials on the router's web management interface (CVSS PR:H), which is typically reachable only from the LAN unless remote administration is enabled; default or weak admin passwords on consumer routers reduce that barrier. No public exploit code was identified at time of analysis.
Stack-based buffer overflow in the boa web server of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding valid administrative credentials to achieve arbitrary code execution by sending a crafted HTTP request that oversizes the static_dns2 parameter to the formIpv6Setup handler. The flaw carries a CVSS 3.1 base score of 9.1, but exploitation is gated by PR:H - the attacker must first authenticate to the web management interface and have network reachability to it, so unauthenticated or internet-wide mass exploitation is not indicated by the available data. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released patch has been identified; risk is concentrated on devices whose administrative interface is WAN-exposed or protected by default or weak credentials.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa HTTP server's formIpv6Setup handler. An attacker who already holds administrative credentials can send a crafted HTTP request with an oversized static_dns1 parameter to corrupt stack memory and potentially execute arbitrary code. The flaw is rated CVSS 9.1 but requires high-privilege access to the management interface; no public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Stack-based buffer overflow in the TOTOLINK X2000R router's boa web management server allows an authenticated administrator to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup endpoint carrying an oversized dhcp_dns2 parameter. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed affected, and the attack requires a valid high-privilege session (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N) on the device's web interface, meaning real-world exploitation generally depends on default-credential reuse or chaining with a separate authentication bypass. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released fix is confirmed in the available data.
Arbitrary code execution in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) requires an attacker to first authenticate to the boa administrative web interface, then send a crafted HTTP request whose dhcp_dns1 parameter overflows a fixed-size stack buffer in the formIpv6Setup handler. Successful exploitation corrupts stack memory and can redirect execution to attacker-controlled data, giving code execution on the device with the web server's privileges. The CVSS vector (PR:H) and the Talos report both confirm that valid high-privilege admin credentials are a hard prerequisite, so the practical threat is concentrated on devices whose management interface is exposed to untrusted networks or left on default/weak credentials; no public exploit code or active exploitation was identified at time of analysis.
Stack-based buffer overflow in TOTOLINK X2000R router firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a high-privileged authenticated management user to trigger arbitrary code execution by sending a crafted HTTP request to the boa formFilter endpoint with an oversized vpnPassword parameter. The CVSS vector confirms network reachability, low attack complexity, high privileges required, and no user interaction; risk is concentrated on devices with exposed web administration and weak or default admin credentials. No public exploit was identified at time of analysis.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where the boa web management interface's formFilter handler processes the vpnUser HTTP parameter into a fixed-size stack buffer without adequate bounds checking. An attacker who first obtains administrative credentials (PR:H) can send an oversized vpnUser value to overflow the stack and potentially execute arbitrary code; exposure is limited by the need for valid admin authentication and reachability of the management interface. The authoritative assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis.
Authenticated OS command injection in the TOTOLINK X2000R boa web interface lets an attacker with administrative access execute arbitrary code on the router through the formWizard newPass setup-wizard handler. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and carries a published CVSS score of 9.1; our assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, with high confidentiality, integrity, and availability impact but unchanged scope. Exploitation requires a valid admin session (PR:H), and no CISA KEV listing, public exploit code, or active exploitation was identified at time of analysis.
Authenticated stack-based buffer overflow in the boa formUploadFile handler on TOTOLINK X2000R routers can allow arbitrary code execution when a specially crafted HTTP request is sent to the web management interface. The issue affects the specific firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires administrative credentials (PR:H) plus network reachability to the management UI, which is normally LAN-restricted. No public exploit has been identified at time of analysis, and the vendor/Talos CVSS is 9.1.
Authenticated path traversal in the boa formUploadFile handler of TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an attacker with valid web-management credentials to write arbitrary files and potentially achieve code execution. The issue is high severity but gated by mandatory authentication to the router's HTTP administration interface, so realistic risk is concentrated on devices with exposed admin access or weak/default credentials. No public exploit was identified at time of analysis, and no CISA KEV active-exploitation confirmation is available.
Stack-based buffer overflow in the boa web server's formTR069Config handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a specially crafted HTTP request that overflows a fixed-size stack buffer and can lead to arbitrary code execution on the router. The flaw is network-reachable with low attack complexity, but exploitation requires valid management credentials (CVSS PR:H), making exposure of the administrative interface and credential hygiene the decisive risk factors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 9.1 CRITICAL base score reflects full confidentiality, integrity and availability impact once the authentication barrier is crossed.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router allows anyone holding administrative credentials to run arbitrary commands on the device by sending a crafted HTTP request to the formPasswordSetup endpoint. Only units running firmware V1.0.0-B20250421.1327 are affected, and the CVSS vector (PR:H) confirms the flaw sits behind a high-privileged login, so it is an access-gated post-authentication escalation to full device compromise rather than a pre-auth router takeover. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; the real-world risk comes from internet-exposed management interfaces and from default or reused admin passwords.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa formIpQos handler lets an attacker with administrator credentials send a crafted HTTP request containing a malicious 'mac' parameter to overwrite a stack buffer and achieve arbitrary code execution. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires a valid high-privilege management session plus reachability of the boa web interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and practical risk is concentrated where default or weak admin credentials and WAN-exposed management interfaces are present.
Authenticated administrative users of TOTOLINK X2000R firmware build B20250421.1327 can trigger a stack-based buffer overflow through crafted HTTP requests to the batchupg endpoint, potentially achieving arbitrary code execution. The CVSS vector requires high privileges (PR:H), meaning valid admin credentials are the primary prerequisite, and reachability depends on the management interface being accessible to the attacker. No public exploit code was identified at time of analysis, and no pre-authentication exploitation path is indicated.
OS command injection in the batchupg (batch upgrade) handler of TOTOLINK X2000R firmware build V1.0.0-B20250421.1327 lets an attacker who already holds a valid administrator session on the router's web management interface send a crafted HTTP request that executes arbitrary shell commands on the device, yielding a full compromise of confidentiality, integrity, and availability. The prerequisite of high-privileged web credentials (CVSS PR:H) sharply limits exposure - this is not reachable by an unauthenticated attacker - but the practical risk climbs sharply on units whose admin panel is exposed to the WAN or still uses default/weak credentials. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the flaw was reported by Cisco Talos under TALOS-2026-2435.
Authenticated attackers can trigger a heap-based buffer overflow in the boa web server's formUpload() handler on TOTOLINK X2000R routers running firmware V1.0.0-B20250421.1327, potentially leading to arbitrary code execution. The vulnerability requires valid administrative credentials (PR:H) but no user interaction, and the management interface must be network-reachable. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated attackers who can reach the boa web administration interface on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 can trigger a stack-based buffer overflow by sending a crafted HTTP request to formUpload(), with potential for arbitrary code execution and high confidentiality, integrity, and availability impact. The issue is access-gated: exploitation requires high-privilege router administrator credentials (PR:H) and low complexity once authenticated (AC:L/UI:N), so realistic risk depends on whether the management UI is exposed and protected by default or weak credentials. No public exploit code or CISA KEV active-exploitation listing was identified in the provided data.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding a valid administrative session to send a crafted HTTP request to the formUpload() handler and have unsanitized input executed as a shell command, yielding arbitrary code execution on the device. Reported by Cisco Talos (TALOS-2026-2438) with a high severity score; exploitation requires PR:H admin privileges and network reachability to the management HTTP interface, so exposure is greatest where the admin UI is reachable from the WAN or default/weak credentials are in use. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor-released fix version is referenced in the available data.
A stack-based buffer overflow in the Mcli handler of the TOTOLINK X2000R router's web management interface lets an attacker who supplies a specially crafted HTTP request overwrite stack memory and potentially achieve arbitrary code execution on the device. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 has been confirmed affected, and exploitation requires valid administrative credentials (PR:H in the CVSS vector), so the practical attack path is an authenticated one against an exposed management interface. Vendor severity is rated 9.1 and the flaw was reported by Cisco Talos as TALOS-2026-2439; no public exploit code or confirmed active exploitation was identified at time of analysis, though risk rises sharply on deployments where the admin UI is reachable from the WAN or protected by default/reused credentials.
Unsigned firmware images are accepted and flashed by the boa-based firmware update handler on TOTOLINK X2000R routers running build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, allowing an attacker who already holds administrative web-interface credentials to install arbitrary firmware. The flaw is an improper verification of cryptographic signature (CWE-347): the device performs no meaningful code-signing check on the uploaded image, so a crafted binary can yield persistent, privileged control of the router. Talos rates it CVSS 3.1 base 9.1, though the practical barrier is the PR:H administrative prerequisite; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
OS command injection in the TOTOLINK X6000R wireless router (firmware 9.4.0cu.652_B20230116) allows remote attackers to execute arbitrary shell commands on the device by supplying a crafted file_name argument that is processed by the firmware_check routine behind the /cgi-bin/cstecgi.cgi endpoint. The vendor-derived CVSS 4.0 vector scores this 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems), and our independent assessment is consistent: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating low-complexity, unauthenticated remote exploitation with scope change and full device compromise. No public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis, and real-world exposure is limited to units whose web management interface is reachable from the attacker's position - a WAN-exposed admin interface or an attacker already positioned on the LAN.
Stack-based buffer overflow in the TOTOLINK A3002MU router's QoS Rule Handler allows remote attackers to corrupt memory on the device by supplying oversized addQos, comment, or entry_name arguments to /boafrm/formIpQoS, with high confidentiality, integrity, and availability impact. Only firmware 1.0.0-B20230403.1455 is identified as affected, and publicly available exploit code exists (a published proof-of-concept gist), so anyone who can reach the management interface can attempt it. The published CVSS 4.0 vector scores 9.3 as network-reachable, low-complexity, and unauthenticated (PR:N/UI:N); note however that TOTOLINK /boafrm/ handlers commonly require an authenticated web session, so the realistic risk is concentrated where the admin interface is exposed to the WAN or reachable from an untrusted LAN segment.
Improper authorization in the boa web server on TOTOLINK A3002MU firmware 1.0.0-B20230403.1455 lets remote, unauthenticated attackers reach protected administrative functionality without a valid session, giving them full control over the device's web management interface (high confidentiality, integrity and availability impact). Publicly available exploit code exists against the authentication-check function sub_40FCFC in /bin/boa, so weaponisation effort is low, although no CISA KEV listing or other confirmation of active exploitation was present in the available intelligence at time of analysis. Exposure is the practical limiter: units with WAN-side management enabled are directly internet-exploitable, whereas units whose admin interface is LAN-only require an on-network attacker or a LAN-side pivot.
Authenticated stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface (firmware V3.4.0-B20201030) allows a network-adjacent or remote attacker holding low-privilege credentials to crash or seize control of the device by posting an oversized ApCliWEPKey value to the /boafrm/formAjaxSet handler on the topicurl=setting/setWiFiRepeaterConfig branch. Successful exploitation yields total loss of confidentiality, integrity and availability on the router (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which in a home or small-office context means credential interception, DNS/traffic manipulation, and use of the device as a pivot. No public exploit has been identified at time of analysis, CISA SSVC records exploitation as 'none', and no vendor-released patch or fixed firmware version has been identified; exposure is largely gated by whether the administration interface is reachable (LAN-bound by default, internet-reachable only when remote management is enabled).
Stack-based buffer overflow in the TOTOLINK N150RT (NTR150) web management interface, firmware V3.4.0-B20201030, allows a remote attacker to corrupt memory and potentially gain code execution by sending oversized ip_subnet and fw_ip parameters to the /boafrm/formPortFw port-forwarding handler during the rule-addition flow. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), modeling an unauthenticated, low-complexity attack with full confidentiality, integrity and availability impact, although port-forwarding configuration is normally an admin-authenticated function and the PR:N assertion should be confirmed against the published proof-of-concept material before relying on it. No CISA KEV entry or confirmed public exploit was identified at time of analysis, and realistic exposure is primarily LAN-side unless the management interface has been deliberately exposed to the WAN or internet.
TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030 contains a stack-based buffer overflow in the web management handler /boafrm/formFilter that is triggered when an oversized url parameter is submitted with the addFilterUrl (or addFilterUrlFlag) action flag set, allowing an attacker who can reach the interface to corrupt stack memory and gain full control of the device (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Exploitation is network-reachable and low-complexity but requires low-privilege authenticated access, so the realistic exposure is limited to management interfaces reachable on the LAN or to deployments where WAN-side remote administration has been enabled. No public exploit identified at time of analysis, no CISA KEV entry is present, and SSVC records Exploitation: none with Technical Impact: total; a third-party gist reference is linked but is not confirmed as weaponized exploit code.
OS command injection in the TOTOLINK N150RT SOHO router (firmware 3.4.0-B20201030) lets an attacker who can reach the Web Management Interface and has at least low-privilege credentials execute arbitrary operating-system commands on the device. The flaw is reachable through the /boafrm/formWlSiteSurvey handler, where the 'wlanif' argument is passed unsanitized into a shell command, giving full compromise of confidentiality, integrity and availability (CVSS 4.0 base 8.6; independent assessment maps this to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Publicly available exploit code exists (a reference gist is tagged as an exploit), meaning the technique is already in circulation, but the issue is not confirmed actively exploited (no CISA KEV entry) and it is privilege-gated: the router web interface is normally LAN-facing, so WAN reachability depends on remote administration being enabled.
OS command injection in the Totolink A3002MU router firmware (build Hh-B20211125.1046) lets a remote attacker who holds valid low-privilege credentials execute arbitrary shell commands on the device through the formWsc handler in /boafrm/formWsc by supplying a crafted localPin argument. Because the affected component is the router's BOA web management service, successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 4.0 score 8.6, PR:L, no user interaction), and on consumer routers the required low-privilege session is often trivially satisfied by unchanged default administrative credentials. Publicly available exploit code exists (a published proof-of-concept walkthrough for the A3002MU rce-formWsc path), and although there is no confirmation of active exploitation in CISA KEV, the combination of a public PoC, a network-reachable attack surface and low complexity makes this a high-priority patching target for internet- or LAN-exposed devices.
A stack-based buffer overflow in the TOTOLINK A3002MU wireless router (firmware Hh-B20211125.1046) allows remote attackers to corrupt memory through the 'submit-url' argument handled by the formWlWds function at /boafrm/formWlWds, with the CVSS 4.0 vector scoring 9.3 and indicating no authentication or user interaction prerequisite (PR:N/UI:N), though the independent assessment notes the endpoint's pre-authentication status is not explicitly confirmed by the description. Impact is potentially full compromise of confidentiality, integrity, and availability on the device, but practical success depends on network reachability to the Boa web management interface, the specific firmware build, and the difficulty of converting an embedded-MIPS stack overflow into reliable code execution rather than a simple crash. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing) at time of analysis.
Buffer overflow in the TOTOLINK A3002MU router (firmware Hh-B20211125.1046) lets remote attackers corrupt memory by sending a crafted submit-url value to the /boafrm/formWlEncrypt endpoint, with the vendor's CVSS 4.0 vector rated 9.3 and full confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The CVSS 4.0 vector specifies PR:N and UI:N, meaning the attack is unauthenticated and requires no user interaction, and publicly available exploit code exists, though no confirmed active exploitation has been reported (no CISA KEV listing). The dominant practical gating factor is exposure of the device's boa-based HTTP management interface, which on most SOHO deployments is reachable only from the LAN, narrowing the threat to local or adjacent-network attackers unless remote administration is enabled.
A buffer overflow in TOTOLINK A3002MU routers running firmware Hh-B20211125.1046 lets an authenticated remote attacker corrupt memory by sending an oversized submit-url value to the formWlAc handler at /boafrm/formWlAc, potentially gaining full control over the device's confidentiality, integrity and availability. Publicly available exploit code exists - a proof-of-concept write-up is published on GitHub and the flaw is documented by VulDB - but there is no evidence of confirmed active exploitation (CISA KEV). Multiple signals align to a moderate-to-high real-world risk, with the practical prerequisite being valid credentials or an active admin session and a management interface reachable from the attacker's network.
Authenticated buffer overflow in the web management interface of the TOTOLINK A3002MU router (firmware build Hh-B20211125.1046) lets an attacker who already holds a valid management session corrupt memory via an oversized 'webpage' argument submitted to /boafrm/formSchedule, with the potential for code execution and full loss of confidentiality, integrity, and availability. The reporting source rates it 8.6 (CVSS 4.0), and publicly available exploit code exists, but there is no confirmed active exploitation and the flaw is not in CISA KEV. In practice this is a genuine but moderate-priority issue: the CVSS vector's PR:L and the device's normally LAN-only management plane mean the attacker needs authenticated access reachable to the router's admin interface, so risk rises sharply only where remote/WAN administration or default credentials are exposed.
Hardcoded root credentials in TOTOLINK X5000R firmware V9.1.0cu.2415_B20250515 allow unauthenticated remote attackers to gain full administrative control, leading to complete compromise of confidentiality, integrity, and availability. The issue requires network reachability to an authentication service (such as Telnet, SSH, or the web management interface) that accepts the static credential, which is a trivial condition once that service is exposed; however, on typical SOHO deployments the management interface is bound to the LAN, so internet-based exploitation necessitates WAN exposure of the admin service. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the EPSS score is low (0.19%, 9th percentile).
Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis.
Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis.
Buffer overflow in TOTOLINK CP450 4.1.0's web CGI handler allows low-privileged remote attackers to corrupt memory and likely execute arbitrary code by supplying an oversized value to the `topicurl` argument in `/cgi-bin/cstecgi.cgi`. The CVSS 4.0 threat metric E:P confirms proof-of-concept exploit code exists, elevating this beyond a theoretical concern. No vendor patch or advisory has been published, leaving affected devices exposed with only compensating controls available.
Unauthenticated state tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite the mesh slave-IP inventory by publishing a crafted MQTT message to the cs_broker component, which performs no access control on the updateSlaveIpList function. Any attacker able to reach the MQTT broker can corrupt the router's internal record of mesh slave device addresses, disrupting mesh coordination. No public exploit has been identified and EPSS is low (0.17%), but the flaw is unauthenticated and MITRE-reported.
Incorrect access control in the recvIndirectMeshInfo function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers insert or replace mesh neighbor records by sending a crafted MQTT message to the cs_broker component. The CVSS 9.8 rating reflects an unauthenticated network-facing vector, but the primary real impact is integrity (poisoning of the mesh neighbor table), with no confidentiality read and only indirect availability effect. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile).
Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch.
Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete MAC address filter rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delMacFilterRules function. Because no authentication is required, an attacker on the network path can silently strip a device-access control layer, potentially allowing previously blocked/rogue devices onto the LAN. No public exploit identified at time of analysis, and the EPSS score is very low (0.16%, 6th percentile) despite the headline 9.8 CVSS.
Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive.
Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation.
Memory corruption in TOTOLINK A720R router firmware 4.1.5cu.630_B20250509 allows authenticated remote attackers to trigger a buffer overflow in the MAC filtering subsystem, with potential for arbitrary code execution. The vulnerable path is the `setMacFilterRules` function within `cstecgi.cgi`, exploitable by sending a crafted `desc` argument over the network. A public proof-of-concept is available on GitHub; no CISA KEV listing exists at time of analysis, but the combination of network reachability and published exploit code meaningfully elevates real-world risk.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected client MAC addresses to any remote attacker via the getStationMacByIp CGI function. The /cgi-bin/cstecgi.cgi endpoint processes crafted POST requests without enforcing any access control, returning MAC address data that can enable network reconnaissance and bypass of MAC-based access filtering. No confirmed active exploitation or CISA KEV listing exists, and EPSS probability is negligible at 0.18%, though the fully unauthenticated network vector makes automated scanning trivial.
Unauthenticated network topology and interface configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker with access to the device's web management interface to retrieve sensitive network layout data without credentials. The getNetInfoCfg function in /cgi-bin/cstecgi.cgi enforces no access control, so a single crafted POST request returns interface and topology details that support downstream reconnaissance and targeted follow-on attacks. No public exploit code is confirmed and EPSS sits at 0.18% (7th percentile), but SOHO routers are frequently internet-exposed with factory defaults intact, elevating practical risk above what EPSS alone implies.
Unauthenticated online client enumeration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes connected device information to any attacker who can reach the router's HTTP management interface. The getOnlineClient function within the /cgi-bin/cstecgi.cgi CGI dispatcher applies no access control, so a crafted POST request returns the router's live client inventory without credentials. No public exploit has been identified at time of analysis and the EPSS score sits at 0.18% (7th percentile), indicating this is not being exploited at scale - consistent with a batch of researcher-coordinated disclosures across multiple T6 CGI endpoints rather than active threat actor campaigns.
Unauthenticated IPTV and IGMP configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to retrieve multicast group settings, IPTV server parameters, and IGMP proxy configuration without credentials. The getIptvCfg function in the router's CGI web interface fails to enforce access control, accepting a crafted POST to /cgi-bin/cstecgi.cgi and returning configuration data to unauthenticated callers. No public exploit has been identified at time of analysis, and EPSS at 0.18% (7th percentile) indicates minimal current exploitation interest.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh routing table data through the getMeshRoutingTable CGI function. An attacker with network access to the device can send a crafted POST request to /cgi-bin/cstecgi.cgi and retrieve internal mesh routing topology without any credentials. No public exploit has been identified at time of analysis, and EPSS probability is low at 0.18%, though GitHub-hosted CVE coordination repositories suggest researcher awareness and POC development activity.
Unauthenticated access to the getWiFiMeshConfig endpoint on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh network configuration and runtime state to any attacker reachable over the management interface. The CGI handler at /cgi-bin/cstecgi.cgi fails to enforce authentication before executing getWiFiMeshConfig, returning sensitive mesh topology data in response to a single crafted POST request with no credentials. No public exploit or active exploitation has been identified; EPSS at 0.18% (7th percentile) and SSVC exploitation=none confirm low observed exploitation pressure despite the SSVC automatable=yes rating.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes cloud remote-control (CRPC) status and management URL through the getCrpcCfg function. The /cgi-bin/cstecgi.cgi endpoint processes POST requests without enforcing access control, allowing any network-adjacent attacker to enumerate whether cloud remote management is active and retrieve its target URL. No public exploit has been identified at time of analysis and EPSS sits at the 7th percentile, indicating low current exploitation pressure despite the trivially simple attack vector.
Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in the Totolink NR1800X router (firmware 9.1.0u.6279_B20210910) lets remote attackers corrupt memory by supplying an oversized HTTP Host header to the Form_Logout handler at /formLogout.htm, served by the embedded lighttpd web interface. Because the flaw is reachable over the network without authentication and publicly available exploit code exists, it is a strong candidate for opportunistic exploitation despite not yet appearing in CISA KEV. Successful exploitation can crash the device or, given the CWE-121 stack overwrite, potentially achieve code execution on the router.
Least-privilege violation across multiple TOTOLINK SOHO router models (A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200 through firmware 20260906) stems from the /etc/boa/boa.conf configuration of the Boa web-server interface, allowing a low-privileged remote actor to gain access or information beyond their intended authorization boundary. The flaw carries CVSS 4.0 base score 7.7 with high attack complexity, and VulDB rates real-world exploitation as difficult. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stack-based buffer overflow in the Totolink EX1200L router's login handler (cgi-bin/cstecgi.cgi) allows remote attackers on the adjacent network to crash the device or execute arbitrary code as root. Confirmed on firmware 9.3.5u.6146_B20201023 with no public exploit identified at time of analysis, but vendor contact attempts by CERT-PL were unsuccessful so no patch is available. CVSS 4.0 of 9.4 reflects unauthenticated exploitation with full impact on both the device and downstream systems.
Stack-based buffer overflow in the Totolink N300RH router (firmware 6.1c.1353_B20190305) allows remote attackers to corrupt memory via the KeyStr argument processed by the setWiFiBasicConfig function in wireless.so, reachable through the Web Management Interface. Publicly available exploit code exists, and the CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. No CISA KEV listing has been published, so exploitation is not confirmed in the wild despite the public PoC.
OS command injection in the Totolink N300RH router (firmware 6.1c.1353_B20190305) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the admpass argument sent to the setPasswordCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the SSVC framework rates technical impact as total with automatable exploitation, though EPSS remains low at 0.20%. The flaw is reachable over the network without authentication or user interaction, giving an attacker full control of the device.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands via the 'enable' parameter of the setParentalRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and while the EPSS score of 0.89% (76th percentile) suggests moderate predicted exploitation likelihood, the network-accessible attack surface on an edge device elevates real-world risk significantly.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'mac' parameter sent to the setAccessDeviceCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and SSVC rates the technical impact as total with automatable exploitation, though EPSS remains modest at 0.89% (76th percentile). No CISA KEV listing has been published at time of analysis.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the admpass parameter sent to the setPasswordCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the flaw is reachable over the network without user interaction, though no public exploit identified at time of analysis indicates active in-the-wild abuse via CISA KEV.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated remote attackers to execute arbitrary operating system commands via the Comment parameter handled by the setIpQosRules function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the SSVC framework rates the technical impact as total with automatable exploitation, though no public exploit identified at time of analysis as actively exploited in the CISA KEV catalog. EPSS sits at 0.89% (76th percentile), suggesting moderate but non-trivial exploitation interest.
Remote OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows unauthenticated attackers to execute arbitrary operating system commands through the setWanCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' parameter. Publicly available exploit code exists, and with CVSS 4.0 score of 8.9 (network-reachable, low complexity, no privileges required), exposed devices face high risk despite an EPSS score of 0.89% (76th percentile) indicating moderate near-term exploitation probability.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the FileName argument in the UploadFirmwareFile function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB reporting, and SSVC rates this as automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile) indicating no broad mass-exploitation campaign yet observed.
Remote OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows unauthenticated attackers to execute arbitrary commands via the setOpenVpnCfg function in /cgi-bin/cstecgi.cgi by manipulating the 'enabled' argument. Publicly available exploit code exists, raising the risk of opportunistic attacks against exposed devices, though EPSS scoring (0.89%, 76th percentile) suggests moderate but not yet widespread exploitation. The flaw stems from improper neutralization of OS command elements (CWE-78) in the router's Web Management Interface.
OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the FileName parameter in the UploadOpenVpnCert function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists per VulDB disclosure, and SSVC scoring indicates the flaw is automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile). The vulnerability is no public exploit identified in CISA KEV, but POC availability combined with network-reachable management interface elevates real-world risk.
OS command injection in the Totolink A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary commands via the servername parameter of the setOpenVpnCertGenerationCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub PoC), and although the EPSS score is modest (0.89%, 76th percentile), the CVSS 4.0 score of 8.9 reflects network-reachable, no-privilege, no-interaction exploitation with high confidentiality, integrity, and availability impact. No CISA KEV listing has been recorded at the time of analysis.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' argument passed to the setL2tpServerCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published on GitHub), though EPSS probability remains modest at 0.94% (76th percentile), and the issue is not currently listed in CISA KEV.