TOTOLINK
Monthly
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via a crafted MAC address parameter to the setAccessDeviceCfg function in /cgi-bin/cstecgi.cgi. CVSS 9.8 (Critical) with publicly available exploit code on GitHub. No authentication, low complexity, network-exploitable. EPSS and KEV data not available, but public POC significantly lowers exploitation barrier for opportunistic attacks against internet-exposed router management interfaces.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setLedCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (GitHub), making this vulnerability immediately weaponizable with CVSS 9.8 (Critical). EPSS data not available, but no CISA KEV listing indicates no confirmed widespread exploitation despite POC availability.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via the setTracerouteCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists on GitHub, significantly lowering the attack barrier. CVSS 9.8 (Critical) with network vector, low complexity, and no authentication required indicates maximum exploitability. While not confirmed in CISA KEV, the public POC makes this an immediate patching priority for affected devices.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via crafted requests to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability resides in the setDiagnosisCfg function's insufficient validation of the 'ip' parameter. Publicly available exploit code exists (GitHub POC published), significantly lowering exploitation barriers. CVSS 9.8 (Critical) reflects network-accessible, low-complexity attack requiring no authentication. No vendor-released patch identified at time of analysis.
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setAppCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector, low complexity, and no authentication required. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no CISA KEV listing indicates targeted campaigns have not been observed at time of analysis.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via the 'proto' parameter in setNetworkCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, significantly lowering the exploitation barrier. CVSS 9.8 (Critical) reflects network-accessible attack requiring no authentication or user interaction.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the ttyEnable parameter in the setTtyServiceCfg function of /cgi-bin/cstecgi.cgi. Public exploit code is available (GitHub POC published). CVSS 9.8 critical severity with network vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis, representing immediate risk to internet-facing devices.
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the CGI interface. The setRadvdCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the maxRtrAdvInterval parameter, enabling command injection through crafted HTTP requests. Publicly available exploit code exists on GitHub, significantly lowering exploitation barriers. CVSS 9.8 critical rating reflects network-accessible attack vector with no authentication or user interaction required, enabling full system compromise.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the User parameter in setVpnAccountCfg function at /cgi-bin/cstecgi.cgi endpoint. CVSS 9.8 critical severity with publicly available exploit code documented on GitHub. No authentication, low complexity, network-accessible attack vector enables full system compromise with high confidentiality, integrity, and availability impact.
Remote unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise. Attackers exploit the setPptpServerCfg function in /cgi-bin/cstecgi.cgi CGI handler by injecting malicious commands through the 'enable' parameter. CVSS 9.8 critical severity reflects network-accessible attack requiring no privileges or user interaction. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers seeking router takeover, data exfiltration, or network pivoting.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setUrlFilterRules function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction, granting complete device compromise with potential for lateral network movement. Publicly available exploit code exists (GitHub POC). CVSS 9.8 severity reflects network-accessible attack vector with no privilege requirements.
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability resides in the setPortalConfWeChat function within /cgi-bin/cstecgi.cgi, exploitable by manipulating the 'enable' parameter. CVSS 9.8 severity reflects network-accessible attack vector requiring no authentication or user interaction, with full system compromise potential. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers targeting vulnerable router deployments.
Remote unauthenticated OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows arbitrary command execution via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Attackers exploit the 'enable' parameter without authentication to achieve full system compromise. CVSS 9.8 critical severity reflects network accessibility, no complexity barriers, and complete confidentiality/integrity/availability impact. Publicly available exploit code exists, significantly lowering attack barrier for opportunistic scanning campaigns targeting consumer routers.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the admpass parameter in setLoginPasswordCfg function of /cgi-bin/cstecgi.cgi. Network-accessible with no user interaction required. Publicly available exploit code exists. CVSS 9.8 critical severity reflects complete system compromise potential.
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the tty_server parameter in the setAdvancedInfoShow function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity reflects network-accessible exploitation requiring no authentication or user interaction. Publicly available exploit code exists. Attackers can achieve full system compromise including data exfiltration, configuration tampering, and denial of service against affected routers.
OS command injection in Totolink A7100RU 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via malicious lan_info parameter to setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector requiring no privileges or user interaction. Publicly available exploit code exists. Complete compromise of confidentiality, integrity, and availability achievable through CGI handler manipulation.
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 via unauthenticated manipulation of telnet_enabled parameter in setTelnetCfg function. Critical CVSS 9.8 score reflects network-accessible attack requiring no authentication or user interaction, enabling full system compromise. Publicly available exploit code exists. Impacts router confidentiality, integrity, and availability with potential for complete device takeover and lateral network movement.
Unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows remote attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiGuestCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network-accessible attack vector requiring no authentication or user interaction. Publicly available exploit code exists. Successful exploitation enables complete device compromise with high impact to confidentiality, integrity, and availability.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'mode' parameter in the setWiFiAclRules function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists. Attackers can achieve complete device compromise with high impact to confidentiality, integrity, and availability of the router. No authentication required for exploitation (CVSS PR:N).
Remote OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. This vulnerability enables complete device compromise with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists. No CISA KEV listing identified at time of analysis.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via crafted sambaEnabled parameter in setStorageCfg function of /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists. Network-reachable attack vector requires no user interaction, enabling full system compromise of affected routers.
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the wanIdx parameter in the setDmzCfg function within /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with attack complexity low, no privileges required, and no user interaction. Publicly available exploit code exists. Exploitation enables complete compromise of device confidentiality, integrity, and availability with total technical impact.
OS command injection in Totolink A7100RU router 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'merge' parameter in setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity. Publicly available exploit code exists. Attack requires no authentication or user interaction, enabling complete system compromise including data exfiltration, configuration tampering, and denial of service.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via crafted addrPrefixLen parameter in setIpv6LanCfg function of /cgi-bin/cstecgi.cgi CGI handler. CVSS 9.8 critical severity reflects network-accessible attack vector requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. Publicly available exploit code exists.
Unauthenticated remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise via the setIptvCfg function in /cgi-bin/cstecgi.cgi. Attackers inject malicious commands through the igmpVer parameter without authentication, achieving arbitrary code execution with router privileges. CVSS 9.8 (Critical). Publicly available exploit code exists. No authentication, network-accessible attack vector with low complexity allows immediate weaponization for botnet recruitment, credential theft, or lateral network movement.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in setUPnPCfg function within /cgi-bin/cstecgi.cgi. Publicly available exploit code exists. No vendor-released patch identified at time of analysis. CVSS 8.9 (Critical) reflects network-accessible attack requiring no user interaction.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the pptpPassThru parameter in setVpnPassCfg function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction and achieves full system compromise (confidentiality, integrity, availability). Publicly available exploit code exists. Attack vector is network-accessible without authentication (CVSS 8.9 Critical).
Buffer overflow in Totolink LR350 router firmware 9.3.5u.6369_B20220309 allows remote authenticated attackers to execute arbitrary code via crafted SSID input to the setWiFiGuestCfg function in /cgi-bin/cstecgi.cgi. The vulnerability has a publicly available exploit code and affects the web management interface. CVSS 7.4 (High) with low attack complexity indicates significant risk, though exploitation requires low-privilege authentication (PR:L). No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
This vulnerability is an OS command injection flaw in the setLanCfg function of TOTOLINK X6000R routers running firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. An authenticated attacker with high privileges can execute arbitrary operating system commands by manipulating the Hostname parameter in /usr/sbin/shttpd, potentially leading to complete device compromise. The vulnerability was disclosed via VulDB submission with proof-of-concept information available through reference ID 352475, though no active exploitation (KEV listing) has been reported.
Command injection in TOTOLINK N300RH router firmware 6.1c.1353 via setDiagnosisCfg handler. EPSS 4.0% with PoC available — high exploitation probability for consumer routers.
Stack-based buffer overflow in TOTOLIK A3002RU firmware versions up to V3.0.0-B20220304.1804 allows authenticated attackers to achieve remote code execution through a malicious static_ipv6 parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The high CVSS score of 8.8 reflects the complete compromise of system confidentiality, integrity, and availability for affected devices.
Stack overflow vulnerabilities in TOTOLIK A3002RU V2.1.1 router firmware allow authenticated attackers to achieve remote code execution through malformed vpnUser or vpnPassword parameters. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at risk of complete compromise.
Remote code execution in TOTOLIK A3002RU V2.1.1 firmware results from a stack-based buffer overflow in the DNS configuration function that can be exploited by authenticated network users. Public exploit code exists for this vulnerability, and attackers with valid credentials can achieve full system compromise including code execution and data manipulation. No patch is currently available.
Buffer overflow in Totolink A3600R firmware version 5.9c.4959 allows authenticated remote attackers to execute arbitrary code through the setAppEasyWizardConfig function via a malformed apcliSsid parameter. Public exploit code exists for this vulnerability and no patch is currently available. Affected devices are at high risk given the lack of mitigation options and active exploitation potential.
Buffer overflow in Totolik NR1800X firmware allows authenticated remote attackers to achieve complete system compromise through malformed SSID parameters in the setWizardCfg POST handler. Public exploit code is available and no patch has been released, leaving affected devices vulnerable to remote code execution. This vulnerability requires valid credentials but presents critical risk given the device's network exposure and lack of mitigation options.
Buffer overflow in Totolik LR350 firmware allows authenticated remote attackers to achieve full system compromise through malicious SSID parameters in the wizard configuration endpoint. Public exploit code is available for this vulnerability, and no patch has been released, leaving deployed devices at immediate risk. The flaw requires valid credentials but enables complete confidentiality, integrity, and availability violations with network-level access.
Stack-based buffer overflow in Totolink LR350 firmware (version 9.3.5u.6369_B20220309) allows authenticated remote attackers to achieve complete system compromise through manipulation of the ssid parameter in the WiFi configuration function. Public exploit code is available and no patch has been released, leaving affected devices vulnerable to active exploitation. The vulnerability requires valid credentials but poses critical risk due to high-impact consequences including arbitrary code execution.
Unauthenticated remote attackers can exploit a buffer overflow in the WiFi configuration function of Totolink LR350 firmware version 9.3.5u.6369_B20220309 to achieve remote code execution with full system compromise. The vulnerability exists in the ssid parameter handler of /cgi-bin/cstecgi.cgi and requires only network access to trigger, with public exploit code already available. No patch is currently available for affected devices.
Buffer overflow in Totolink LR350 firmware allows authenticated remote attackers to achieve complete system compromise through a malformed SSID parameter in the WiFi guest configuration function. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with network access and valid credentials can execute arbitrary code with full system privileges.
Buffer overflow in TOTOLIK A3700R firmware version 9.1.2u.5822_B20200513 allows authenticated remote attackers to achieve complete system compromise through manipulation of the ssid parameter in the WiFi guest configuration function. Public exploit code exists for this vulnerability and no patch is currently available. An attacker with network access and valid credentials can execute arbitrary code with full system privileges.
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in the exportOvpn handler of the TOTOLINK X5000R router firmware (9.1.0cu.2089_B20211224 and potentially other versions) allows an authenticated web-UI user to inject shell metacharacters through the 'filetype' argument supplied to /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user, resulting in commands executed with the privileges of the underlying CGI process. The flaw is remotely reachable (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N) and publicly available exploit code exists, so any X5000R with an exposed or weakly-credentialed management interface should be treated as at risk. Impact per the supplied vector is limited (VC:L/VI:L/VA:L) but on an embedded device a successful injection typically yields full control of the appliance and its configuration.
Cross-site scripting in the Anchor Tag Handler of Totolink A3002MU firmware version Hh-B20211125.1046 allows network-accessible attackers with low-privilege credentials to inject malicious scripts into the router's web management interface, which execute in a victim's browser upon interaction. A public proof-of-concept exploit has been published on GitHub, lowering the technical barrier for exploitation. No vendor-released patch has been identified in the available intelligence, and the firmware timestamp (November 2021) suggests this is a long-unsupported build unlikely to receive a security update.
Command injection in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 allows network-accessible attackers with low-privilege credentials to execute arbitrary OS commands by manipulating the 'ussd' parameter in the setUssd function exposed via /cgi-bin/cstecgi.cgi. A proof-of-concept exploit has been publicly released on GitHub, lowering the skill threshold for exploitation. On embedded router firmware, CGI processes typically run with root or near-root privileges, meaning successful exploitation likely yields full device control - a substantially higher real-world impact than the provided CVSS 4.0 score of 2.1 suggests.
Unauthenticated access to the CloudSrvVersionCheck function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to trigger cloud-based firmware update checks by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The root cause is CWE-284 (Improper Access Control) - the function processes requests without verifying caller identity, a systemic pattern observed across multiple CGI handlers in this firmware batch. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.18% (7th percentile) indicates low probability of automated exploitation.
Unauthenticated write access to the setApWiFiSchCfg function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to arbitrarily overwrite the device's AP wireless availability schedule by posting a crafted request to /cgi-bin/cstecgi.cgi. The CVSS PR:N metric confirms no credentials are required; the attack surface is the standard CGI management endpoint. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.16% (6th percentile), but the unauthenticated network vector makes this trivially reproducible against any device exposing its management interface to untrusted networks.
Predictable authentication token generation in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506 exposes the router's web management interface to session token prediction attacks from the network. The loginAuth function in /web_cste/cgi-bin/cstecgi.cgi generates insufficiently random values (CWE-330), enabling unauthenticated remote attackers to predict valid session tokens and gain unauthorized access to router configuration data. A proof-of-concept exploit script (poc.py) is publicly available on GitHub, though high attack complexity limits practical exploitation to technically capable attackers.
Smart QoS configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows unauthenticated attackers on the same network segment to read QoS rules and configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getSmartQosCfg function lacks any access control enforcement, exposing network prioritization policies and associated device rules without credentials. EPSS is low (0.18%, 7th percentile) and no active exploitation has been identified; however, this flaw is consistent with a documented systemic pattern of missing authentication across multiple TOTOLINK T6 CGI endpoints.
Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ntp_server` parameter to the `getCurrentTime` handler at `/cgi-bin/cstecgi.cgi`. A public proof-of-concept demonstrating popen-based injection is available on GitHub, confirmed by the CVSS 4.0 E:P exploit maturity indicator, meaning exploitation requires minimal attacker skill. No vendor-released patch has been identified in available intelligence, leaving internet-exposed devices unmitigated.
Denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows authenticated remote attackers to crash the device by sending a crafted request to the setWizardCfg function in /cgi-bin/cstecgi.cgi, triggering a null pointer dereference. Impact is limited strictly to availability - no confidentiality or integrity compromise - but a publicly available proof-of-concept exploit on GitHub (CVSS 4.0 E:P) significantly lowers the exploitation barrier. No vendor patch has been identified and the device is not listed in CISA KEV, making access restriction to the management interface the primary mitigation.
Remote denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows a low-privileged authenticated attacker to crash the device by submitting a malformed request to the setPasswordCfg function in the CGI-based web management interface. Exploitation triggers a null pointer dereference in /cgi-bin/cstecgi.cgi, rendering the device unresponsive and disrupting its network extension services entirely. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation, though no active exploitation has been recorded in CISA KEV at time of analysis.
Least privilege violation in TOTOLINK CP450 router firmware 4.1.0cu.747 allows low-privileged remote attackers to perform unauthorized integrity-affecting actions via the vsftpd FTP service, whose configuration in /etc/vsftpd.conf grants excessive permissions beyond operational necessity. The vulnerability carries a low CVSS 4.0 score of 2.1, reflecting constrained impact limited to low integrity effects on the vulnerable system with no confidentiality or availability consequence. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been confirmed, indicating no known active widespread exploitation at time of analysis.
Least-privilege violation in TOTOLINK AC1200 T8 firmware 4.1.5cu.8611 exposes the vsftpd FTP service to unauthorized integrity manipulation by low-privileged authenticated network users. The /etc/vsftpd.conf configuration grants excessive permissions beyond the principle of least privilege (CWE-272), allowing a low-privilege authenticated attacker to perform write operations they should not be authorized to execute. A proof-of-concept exploit has been publicly disclosed; the vulnerability is not confirmed in CISA KEV, but the CVSS temporal vector (E:P, RC:R) reflects publicly available exploit code with reasonable confidence in the report.
OS command injection in Totolink CA750-PoE 6.2c.510 allows a low-privileged remote attacker to execute arbitrary operating system commands by manipulating the PIN argument passed to the setWiFiWpsConfig function within /cgi-bin/cstecgi.cgi. The attack requires no user interaction and is reachable over the network, making it a credible threat to any deployment exposing the device's management interface. A public proof-of-concept exploit has been published on GitHub, and EPSS places this at the 87th percentile of exploitation likelihood despite a low raw CVSS 4.0 score of 2.1 - a signal worth noting against the mismatch.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 enables remote attackers with low-level credentials to execute arbitrary operating system commands via the fwUrl and magicid parameters of the recvUpgradeNewFw function within /cgi-bin/cstecgi.cgi. The firmware upgrade Setting Handler fails to sanitize user-supplied input before passing it to the underlying OS shell, exposing the device to command execution. A public proof-of-concept exploit is available on GitHub; while not yet listed in CISA KEV, the EPSS 87th-percentile ranking signals elevated real-world exploitation interest relative to the broader vulnerability landscape.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary shell commands by manipulating the FileName argument passed to the setUploadUserData function within the /cgi-bin/cstecgi.cgi Setting Handler. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the skill barrier for adversaries. While not listed in CISA KEV, the EPSS score of 2.95% at the 87th percentile signals real-world exploitation probability well above average, making this a higher practical risk than the CVSS 4.0 base score of 2.1 alone would suggest.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a network-adjacent authenticated attacker to execute arbitrary operating system commands by manipulating the FileName argument passed to the setUpgradeUboot function within the /cgi-bin/cstecgi.cgi Setting Handler. Publicly available exploit code exists, hosted on GitHub, making exploitation accessible to low-skilled attackers. No public exploit identified in CISA KEV at time of analysis, though the EPSS 87th percentile ranking signals elevated exploitation interest relative to the broader CVE population despite a low absolute probability of 2.95%.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a remote, low-privileged attacker to execute arbitrary operating system commands on the device by manipulating the plugin_version parameter in the setUnloadUserData function of /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit exists on GitHub, and the EPSS percentile (87th) indicates this CVE carries meaningfully higher exploitation likelihood than the majority of published vulnerabilities despite its low CVSS 4.0 base score of 2.1. No public exploit identified as actively exploited (CISA KEV), but POC availability on a network-accessible embedded device warrants prompt attention in exposed deployments.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating network diagnostic parameters in the device's CGI handler. The vulnerable function setNetworkDiag, reachable at /cgi-bin/cstecgi.cgi, passes attacker-controlled values for NetDiagHost, NetDiagPingNum, NetDiagPingSize, NetDiagPingTimeOut, and NetDiagTracertHop directly into OS command execution without sanitization. A public proof-of-concept exploit exists on GitHub; the EPSS score of 2.95% at the 87th percentile indicates elevated exploitation likelihood relative to the broader CVE population, though SSVC assessment rates the attack as not automatable.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a low-privileged remote attacker to execute arbitrary system commands on the device by manipulating the host_time argument passed to the NTPSyncWithHost function within the CGI-based Setting Handler. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation. Despite being an OS command injection - a class of vulnerability typically associated with high-severity scores - the vendor CVSS 4.0 score of 2.1 reflects unusually low impact ratings (VC:L/VI:L/VA:L) that security teams should independently verify, as the 87th-percentile EPSS score signals that this CVE's characteristics are consistent with real-world exploitation interest.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a network-reachable, low-privilege authenticated attacker to execute arbitrary operating system commands by injecting shell metacharacters into the admuser or admpass arguments of the setPasswordCfg function within /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit has been published on GitHub, materially lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving affected deployments dependent on compensating controls.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the webWlanIdx argument within the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. A publicly available proof-of-concept exploit hosted on GitHub exists, materially lowering the skill threshold for exploitation despite the low CVSS 4.0 score of 2.1. No public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), but EPSS places this at the 85th percentile, signaling elevated exploitation likelihood relative to the broader CVE population.
Command injection in Totolink WA300 firmware version 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the hostTime parameter in the NTPSyncWithHost function accessible through /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, though actual real-world exploitation risk is mitigated by the requirement for authenticated access and the low impact scope (limited to confidentiality, integrity, and availability of the application itself, with no system-wide impact).
Command injection in Totolink WA300 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the langType parameter in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, though the low CVSS 2.1 score reflects limited scope (only low confidentiality and integrity impact, no system integrity or availability impact) and authentication requirement, reducing real-world attack surface.
Command injection in Totolink WA300 firmware version 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the webWlanIdx parameter in the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. The vulnerability requires valid user credentials but no user interaction, with publicly available exploit code demonstrating the attack.
External file inclusion in Totolink N300RH firmware 6.1c.1353_B20190305 allows remote unauthenticated attackers to manipulate the FileName parameter in the setUploadSetting function via /cgi-bin/cstecgi.cgi, enabling arbitrary file writes and denial of service. Publicly available exploit code exists, and the vulnerability carries a CVSS score of 6.5 reflecting network-accessible attack vector with low complexity.
Remote code execution in Totolink N300RH firmware 6.1c.1353_B20190305 allows unauthenticated network attackers to execute arbitrary OS commands via command injection in the FileName parameter of the setUpgradeUboot function in upgrade.so. Publicly available exploit code exists for this vulnerability, which carries a CVSS 6.9 score reflecting network-accessible attack vector with low complexity and no authentication requirements.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists on GitHub (EPSS and KEV status not provided, but publicly available proof-of-concept increases immediate risk). Attack vector is network-based with low complexity requiring no user interaction or authentication (CVSS:3.1 AV:N/AC:L/PR:N/UI:N).
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'provider' parameter in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub POC) demonstrating practical exploitation. With CVSS 7.3 and network-accessible attack vector requiring no authentication or user interaction, this represents a significant risk to exposed devices, though no active exploitation confirmed by CISA KEV at time of analysis.
OS command injection in Totolink A3300R firmware version 17.0.0cu.557_B20221024 allows authenticated local attackers to execute arbitrary commands via the stun_pass parameter in the vsetTr069Cfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 5.1 (medium severity) with CVSS:4.0/AV:A/AC:L/PR:L vector indicating adjacent network access and low authentication requirements. Publicly available exploit code exists, though active exploitation status (CISA KEV) is not confirmed.
OS command injection in Totolink A7100RU firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary commands via manipulation of the mode parameter in the setScheduleCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists for this vulnerability, creating immediate risk for exposed devices.
Remote command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary OS commands via manipulation of the resetFlags parameter in the CsteSystem function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists for this vulnerability, which achieves a CVSS 6.9 score with low confidentiality, integrity, and availability impact across multiple scopes.
Authentication bypass in Totolink A8000R 5.9c.681_B20180413 allows remote attackers to manipulate the langType parameter in the setLanguageCfg function at /cgi-bin/cstecgi.cgi to bypass authentication controls without credentials. This unauthenticated remote vulnerability has publicly available exploit code and poses a confirmed risk to exposed router management interfaces.
Command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the vlanPriLan3 parameter in the setIptvCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a publicly available exploit and carries moderate severity (CVSS 6.3) with confirmed exploitability signals (EPSS P/E indicator). Successful exploitation grants an authenticated attacker the ability to manipulate VLAN priority settings and potentially gain code execution on the affected router.
Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via manipulation of the rxRate parameter in the setWiFiBasicCfg function at /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 with publicly available exploit code, making it a moderate-priority issue for affected device administrators despite requiring prior authentication.
Command injection in Totolink A3300R router firmware 17.0.0cu.557_b20221024 allows unauthenticated remote attackers to execute arbitrary system commands via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS vector (AV:N/AC:L/PR:N) confirms network-accessible exploitation with low complexity and no authentication required, enabling pre-authentication remote code execution on affected routers.
Command injection in Totolink A3300R firmware version 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via manipulation of the pptpPassThru parameter in the setVpnPassCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with network-accessible attack vector and low complexity; publicly available exploit code exists, making this an actionable threat for affected deployments.
Command injection in Totolink A3300R router firmware version 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via a crafted ip parameter in the setStaticRoute function of /cgi-bin/cstecgi.cgi. The vulnerability carries a CVSS score of 6.3 (medium severity) with public exploit code available, enabling potential compromise of router configuration and data integrity.
Remote command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the enable parameter in the setUPnPCfg function at /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the vulnerability has a CVSS score of 6.3 with confirmed proof-of-concept demonstrated on GitHub.
Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary system commands via the qos_up_bw parameter in the setSmartQosCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with low attack complexity, and publicly available exploit code exists, though no active exploitation via CISA KEV has been confirmed at time of analysis.
Command injection in Totolink A3300R firmware versions up to 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the lanIp parameter in the setLanCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists for this vulnerability. With a CVSS score of 5.3 and moderate real-world exploitability, this presents a meaningful risk to affected router installations.
Command injection in Totolink NR1800X firmware 9.1.0u.6279_B20210910 allows authenticated remote attackers to execute arbitrary commands via the host_time parameter in the NTPSyncWithHost function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with publicly available exploit code, though it requires valid login credentials to exploit. Real-world risk is moderate given the authentication requirement and moderate EPSS probability (indicated by E:P in vector).
Command injection in Totolink A3600R firmware 4.1.2cu.5182_B20201102 allows authenticated remote attackers to execute arbitrary commands via the NoticeUrl parameter in the setNoticeCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (low-to-medium severity) but is confirmed by publicly available exploit code, making it an active threat to deployed devices despite the authentication requirement.
A critical OS command injection vulnerability exists in Totolink WA300 router firmware version 5.2cu.7112_B20190227, specifically in the recvUpgradeNewFw function within /cgi-bin/cstecgi.cgi. An unauthenticated remote attacker can exploit this flaw to execute arbitrary operating system commands on the affected device. A public proof-of-concept exploit has been released on GitHub, significantly lowering the barrier to exploitation and increasing real-world risk.
OS command injection in Totolink N300RH firmware allows unauthenticated remote attackers to execute arbitrary commands through the setWiFiWpsConfig function in the CGI handler. Public exploit code exists for this vulnerability, and no patch is currently available. Affected users should restrict network access to the device's management interface until a fix is released.
X5000R Firmware versions up to 9.1.0cu.2415_b20250515 is affected by uncontrolled resource consumption (CVSS 7.5).
X6000R Firmware versions up to 9.4.0cu.1498_b20250826 is affected by os command injection (CVSS 8.8).
Argument injection in TOTOLINK X5000R router v9.1.0cu via setDiagnosisCfg handler allows unauthenticated remote code execution. EPSS 2.0% with PoC available.
X5000R Firmware versions up to 9.1.0cu.2415_b20250515 is affected by os command injection (CVSS 8.0).
OS command injection in Totolik WA300 firmware via the setAPNetwork function allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw affects firmware version 5.2cu.7112_B20190227 and impacts the /cgi-bin/cstecgi.cgi endpoint through manipulation of the Ipaddr parameter.
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via a crafted MAC address parameter to the setAccessDeviceCfg function in /cgi-bin/cstecgi.cgi. CVSS 9.8 (Critical) with publicly available exploit code on GitHub. No authentication, low complexity, network-exploitable. EPSS and KEV data not available, but public POC significantly lowers exploitation barrier for opportunistic attacks against internet-exposed router management interfaces.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setLedCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (GitHub), making this vulnerability immediately weaponizable with CVSS 9.8 (Critical). EPSS data not available, but no CISA KEV listing indicates no confirmed widespread exploitation despite POC availability.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via the setTracerouteCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists on GitHub, significantly lowering the attack barrier. CVSS 9.8 (Critical) with network vector, low complexity, and no authentication required indicates maximum exploitability. While not confirmed in CISA KEV, the public POC makes this an immediate patching priority for affected devices.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via crafted requests to the /cgi-bin/cstecgi.cgi endpoint. The vulnerability resides in the setDiagnosisCfg function's insufficient validation of the 'ip' parameter. Publicly available exploit code exists (GitHub POC published), significantly lowering exploitation barriers. CVSS 9.8 (Critical) reflects network-accessible, low-complexity attack requiring no authentication. No vendor-released patch identified at time of analysis.
OS command injection in Totolink A7100RU router firmware (version 7.4cu.2313_b20191024) allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setAppCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector, low complexity, and no authentication required. Publicly available exploit code exists on GitHub, significantly lowering the barrier to exploitation, though no CISA KEV listing indicates targeted campaigns have not been observed at time of analysis.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands with router privileges via the 'proto' parameter in setNetworkCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, significantly lowering the exploitation barrier. CVSS 9.8 (Critical) reflects network-accessible attack requiring no authentication or user interaction.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the ttyEnable parameter in the setTtyServiceCfg function of /cgi-bin/cstecgi.cgi. Public exploit code is available (GitHub POC published). CVSS 9.8 critical severity with network vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis, representing immediate risk to internet-facing devices.
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the CGI interface. The setRadvdCfg function in /cgi-bin/cstecgi.cgi fails to sanitize the maxRtrAdvInterval parameter, enabling command injection through crafted HTTP requests. Publicly available exploit code exists on GitHub, significantly lowering exploitation barriers. CVSS 9.8 critical rating reflects network-accessible attack vector with no authentication or user interaction required, enabling full system compromise.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the User parameter in setVpnAccountCfg function at /cgi-bin/cstecgi.cgi endpoint. CVSS 9.8 critical severity with publicly available exploit code documented on GitHub. No authentication, low complexity, network-accessible attack vector enables full system compromise with high confidentiality, integrity, and availability impact.
Remote unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise. Attackers exploit the setPptpServerCfg function in /cgi-bin/cstecgi.cgi CGI handler by injecting malicious commands through the 'enable' parameter. CVSS 9.8 critical severity reflects network-accessible attack requiring no privileges or user interaction. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers seeking router takeover, data exfiltration, or network pivoting.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setUrlFilterRules function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction, granting complete device compromise with potential for lateral network movement. Publicly available exploit code exists (GitHub POC). CVSS 9.8 severity reflects network-accessible attack vector with no privilege requirements.
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands. The vulnerability resides in the setPortalConfWeChat function within /cgi-bin/cstecgi.cgi, exploitable by manipulating the 'enable' parameter. CVSS 9.8 severity reflects network-accessible attack vector requiring no authentication or user interaction, with full system compromise potential. Publicly available exploit code exists, significantly lowering exploitation barrier for remote attackers targeting vulnerable router deployments.
Remote unauthenticated OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 allows arbitrary command execution via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Attackers exploit the 'enable' parameter without authentication to achieve full system compromise. CVSS 9.8 critical severity reflects network accessibility, no complexity barriers, and complete confidentiality/integrity/availability impact. Publicly available exploit code exists, significantly lowering attack barrier for opportunistic scanning campaigns targeting consumer routers.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the admpass parameter in setLoginPasswordCfg function of /cgi-bin/cstecgi.cgi. Network-accessible with no user interaction required. Publicly available exploit code exists. CVSS 9.8 critical severity reflects complete system compromise potential.
OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the tty_server parameter in the setAdvancedInfoShow function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity reflects network-accessible exploitation requiring no authentication or user interaction. Publicly available exploit code exists. Attackers can achieve full system compromise including data exfiltration, configuration tampering, and denial of service against affected routers.
OS command injection in Totolink A7100RU 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via malicious lan_info parameter to setMiniuiHomeInfoShow function in /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network attack vector requiring no privileges or user interaction. Publicly available exploit code exists. Complete compromise of confidentiality, integrity, and availability achievable through CGI handler manipulation.
Remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 via unauthenticated manipulation of telnet_enabled parameter in setTelnetCfg function. Critical CVSS 9.8 score reflects network-accessible attack requiring no authentication or user interaction, enabling full system compromise. Publicly available exploit code exists. Impacts router confidentiality, integrity, and availability with potential for complete device takeover and lateral network movement.
Unauthenticated OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows remote attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiGuestCfg function of /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity with network-accessible attack vector requiring no authentication or user interaction. Publicly available exploit code exists. Successful exploitation enables complete device compromise with high impact to confidentiality, integrity, and availability.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'mode' parameter in the setWiFiAclRules function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists. Attackers can achieve complete device compromise with high impact to confidentiality, integrity, and availability of the router. No authentication required for exploitation (CVSS PR:N).
Remote OS command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary system commands via the wifiOff parameter in the setWiFiBasicCfg function of /cgi-bin/cstecgi.cgi. This vulnerability enables complete device compromise with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists. No CISA KEV listing identified at time of analysis.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via crafted sambaEnabled parameter in setStorageCfg function of /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists. Network-reachable attack vector requires no user interaction, enabling full system compromise of affected routers.
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the wanIdx parameter in the setDmzCfg function within /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with attack complexity low, no privileges required, and no user interaction. Publicly available exploit code exists. Exploitation enables complete compromise of device confidentiality, integrity, and availability with total technical impact.
OS command injection in Totolink A7100RU router 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'merge' parameter in setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. CVSS 9.8 critical severity. Publicly available exploit code exists. Attack requires no authentication or user interaction, enabling complete system compromise including data exfiltration, configuration tampering, and denial of service.
OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via crafted addrPrefixLen parameter in setIpv6LanCfg function of /cgi-bin/cstecgi.cgi CGI handler. CVSS 9.8 critical severity reflects network-accessible attack vector requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. Publicly available exploit code exists.
Unauthenticated remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise via the setIptvCfg function in /cgi-bin/cstecgi.cgi. Attackers inject malicious commands through the igmpVer parameter without authentication, achieving arbitrary code execution with router privileges. CVSS 9.8 (Critical). Publicly available exploit code exists. No authentication, network-accessible attack vector with low complexity allows immediate weaponization for botnet recruitment, credential theft, or lateral network movement.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in setUPnPCfg function within /cgi-bin/cstecgi.cgi. Publicly available exploit code exists. No vendor-released patch identified at time of analysis. CVSS 8.9 (Critical) reflects network-accessible attack requiring no user interaction.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the pptpPassThru parameter in setVpnPassCfg function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction and achieves full system compromise (confidentiality, integrity, availability). Publicly available exploit code exists. Attack vector is network-accessible without authentication (CVSS 8.9 Critical).
Buffer overflow in Totolink LR350 router firmware 9.3.5u.6369_B20220309 allows remote authenticated attackers to execute arbitrary code via crafted SSID input to the setWiFiGuestCfg function in /cgi-bin/cstecgi.cgi. The vulnerability has a publicly available exploit code and affects the web management interface. CVSS 7.4 (High) with low attack complexity indicates significant risk, though exploitation requires low-privilege authentication (PR:L). No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
This vulnerability is an OS command injection flaw in the setLanCfg function of TOTOLINK X6000R routers running firmware versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826. An authenticated attacker with high privileges can execute arbitrary operating system commands by manipulating the Hostname parameter in /usr/sbin/shttpd, potentially leading to complete device compromise. The vulnerability was disclosed via VulDB submission with proof-of-concept information available through reference ID 352475, though no active exploitation (KEV listing) has been reported.
Command injection in TOTOLINK N300RH router firmware 6.1c.1353 via setDiagnosisCfg handler. EPSS 4.0% with PoC available — high exploitation probability for consumer routers.
Stack-based buffer overflow in TOTOLIK A3002RU firmware versions up to V3.0.0-B20220304.1804 allows authenticated attackers to achieve remote code execution through a malicious static_ipv6 parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The high CVSS score of 8.8 reflects the complete compromise of system confidentiality, integrity, and availability for affected devices.
Stack overflow vulnerabilities in TOTOLIK A3002RU V2.1.1 router firmware allow authenticated attackers to achieve remote code execution through malformed vpnUser or vpnPassword parameters. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at risk of complete compromise.
Remote code execution in TOTOLIK A3002RU V2.1.1 firmware results from a stack-based buffer overflow in the DNS configuration function that can be exploited by authenticated network users. Public exploit code exists for this vulnerability, and attackers with valid credentials can achieve full system compromise including code execution and data manipulation. No patch is currently available.
Buffer overflow in Totolink A3600R firmware version 5.9c.4959 allows authenticated remote attackers to execute arbitrary code through the setAppEasyWizardConfig function via a malformed apcliSsid parameter. Public exploit code exists for this vulnerability and no patch is currently available. Affected devices are at high risk given the lack of mitigation options and active exploitation potential.
Buffer overflow in Totolik NR1800X firmware allows authenticated remote attackers to achieve complete system compromise through malformed SSID parameters in the setWizardCfg POST handler. Public exploit code is available and no patch has been released, leaving affected devices vulnerable to remote code execution. This vulnerability requires valid credentials but presents critical risk given the device's network exposure and lack of mitigation options.
Buffer overflow in Totolik LR350 firmware allows authenticated remote attackers to achieve full system compromise through malicious SSID parameters in the wizard configuration endpoint. Public exploit code is available for this vulnerability, and no patch has been released, leaving deployed devices at immediate risk. The flaw requires valid credentials but enables complete confidentiality, integrity, and availability violations with network-level access.
Stack-based buffer overflow in Totolink LR350 firmware (version 9.3.5u.6369_B20220309) allows authenticated remote attackers to achieve complete system compromise through manipulation of the ssid parameter in the WiFi configuration function. Public exploit code is available and no patch has been released, leaving affected devices vulnerable to active exploitation. The vulnerability requires valid credentials but poses critical risk due to high-impact consequences including arbitrary code execution.
Unauthenticated remote attackers can exploit a buffer overflow in the WiFi configuration function of Totolink LR350 firmware version 9.3.5u.6369_B20220309 to achieve remote code execution with full system compromise. The vulnerability exists in the ssid parameter handler of /cgi-bin/cstecgi.cgi and requires only network access to trigger, with public exploit code already available. No patch is currently available for affected devices.
Buffer overflow in Totolink LR350 firmware allows authenticated remote attackers to achieve complete system compromise through a malformed SSID parameter in the WiFi guest configuration function. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker with network access and valid credentials can execute arbitrary code with full system privileges.
Buffer overflow in TOTOLIK A3700R firmware version 9.1.2u.5822_B20200513 allows authenticated remote attackers to achieve complete system compromise through manipulation of the ssid parameter in the WiFi guest configuration function. Public exploit code exists for this vulnerability and no patch is currently available. An attacker with network access and valid credentials can execute arbitrary code with full system privileges.
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in the exportOvpn handler of the TOTOLINK X5000R router firmware (9.1.0cu.2089_B20211224 and potentially other versions) allows an authenticated web-UI user to inject shell metacharacters through the 'filetype' argument supplied to /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user, resulting in commands executed with the privileges of the underlying CGI process. The flaw is remotely reachable (CVSS 4.0 AV:N/AC:L/AT:N/PR:L/UI:N) and publicly available exploit code exists, so any X5000R with an exposed or weakly-credentialed management interface should be treated as at risk. Impact per the supplied vector is limited (VC:L/VI:L/VA:L) but on an embedded device a successful injection typically yields full control of the appliance and its configuration.
Cross-site scripting in the Anchor Tag Handler of Totolink A3002MU firmware version Hh-B20211125.1046 allows network-accessible attackers with low-privilege credentials to inject malicious scripts into the router's web management interface, which execute in a victim's browser upon interaction. A public proof-of-concept exploit has been published on GitHub, lowering the technical barrier for exploitation. No vendor-released patch has been identified in the available intelligence, and the firmware timestamp (November 2021) suggests this is a long-unsupported build unlikely to receive a security update.
Command injection in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 allows network-accessible attackers with low-privilege credentials to execute arbitrary OS commands by manipulating the 'ussd' parameter in the setUssd function exposed via /cgi-bin/cstecgi.cgi. A proof-of-concept exploit has been publicly released on GitHub, lowering the skill threshold for exploitation. On embedded router firmware, CGI processes typically run with root or near-root privileges, meaning successful exploitation likely yields full device control - a substantially higher real-world impact than the provided CVSS 4.0 score of 2.1 suggests.
Unauthenticated access to the CloudSrvVersionCheck function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to trigger cloud-based firmware update checks by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The root cause is CWE-284 (Improper Access Control) - the function processes requests without verifying caller identity, a systemic pattern observed across multiple CGI handlers in this firmware batch. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.18% (7th percentile) indicates low probability of automated exploitation.
Unauthenticated write access to the setApWiFiSchCfg function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to arbitrarily overwrite the device's AP wireless availability schedule by posting a crafted request to /cgi-bin/cstecgi.cgi. The CVSS PR:N metric confirms no credentials are required; the attack surface is the standard CGI management endpoint. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.16% (6th percentile), but the unauthenticated network vector makes this trivially reproducible against any device exposing its management interface to untrusted networks.
Predictable authentication token generation in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506 exposes the router's web management interface to session token prediction attacks from the network. The loginAuth function in /web_cste/cgi-bin/cstecgi.cgi generates insufficiently random values (CWE-330), enabling unauthenticated remote attackers to predict valid session tokens and gain unauthorized access to router configuration data. A proof-of-concept exploit script (poc.py) is publicly available on GitHub, though high attack complexity limits practical exploitation to technically capable attackers.
Smart QoS configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows unauthenticated attackers on the same network segment to read QoS rules and configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getSmartQosCfg function lacks any access control enforcement, exposing network prioritization policies and associated device rules without credentials. EPSS is low (0.18%, 7th percentile) and no active exploitation has been identified; however, this flaw is consistent with a documented systemic pattern of missing authentication across multiple TOTOLINK T6 CGI endpoints.
Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ntp_server` parameter to the `getCurrentTime` handler at `/cgi-bin/cstecgi.cgi`. A public proof-of-concept demonstrating popen-based injection is available on GitHub, confirmed by the CVSS 4.0 E:P exploit maturity indicator, meaning exploitation requires minimal attacker skill. No vendor-released patch has been identified in available intelligence, leaving internet-exposed devices unmitigated.
Denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows authenticated remote attackers to crash the device by sending a crafted request to the setWizardCfg function in /cgi-bin/cstecgi.cgi, triggering a null pointer dereference. Impact is limited strictly to availability - no confidentiality or integrity compromise - but a publicly available proof-of-concept exploit on GitHub (CVSS 4.0 E:P) significantly lowers the exploitation barrier. No vendor patch has been identified and the device is not listed in CISA KEV, making access restriction to the management interface the primary mitigation.
Remote denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows a low-privileged authenticated attacker to crash the device by submitting a malformed request to the setPasswordCfg function in the CGI-based web management interface. Exploitation triggers a null pointer dereference in /cgi-bin/cstecgi.cgi, rendering the device unresponsive and disrupting its network extension services entirely. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation, though no active exploitation has been recorded in CISA KEV at time of analysis.
Least privilege violation in TOTOLINK CP450 router firmware 4.1.0cu.747 allows low-privileged remote attackers to perform unauthorized integrity-affecting actions via the vsftpd FTP service, whose configuration in /etc/vsftpd.conf grants excessive permissions beyond operational necessity. The vulnerability carries a low CVSS 4.0 score of 2.1, reflecting constrained impact limited to low integrity effects on the vulnerable system with no confidentiality or availability consequence. A publicly available proof-of-concept exploit exists, and no CISA KEV listing has been confirmed, indicating no known active widespread exploitation at time of analysis.
Least-privilege violation in TOTOLINK AC1200 T8 firmware 4.1.5cu.8611 exposes the vsftpd FTP service to unauthorized integrity manipulation by low-privileged authenticated network users. The /etc/vsftpd.conf configuration grants excessive permissions beyond the principle of least privilege (CWE-272), allowing a low-privilege authenticated attacker to perform write operations they should not be authorized to execute. A proof-of-concept exploit has been publicly disclosed; the vulnerability is not confirmed in CISA KEV, but the CVSS temporal vector (E:P, RC:R) reflects publicly available exploit code with reasonable confidence in the report.
OS command injection in Totolink CA750-PoE 6.2c.510 allows a low-privileged remote attacker to execute arbitrary operating system commands by manipulating the PIN argument passed to the setWiFiWpsConfig function within /cgi-bin/cstecgi.cgi. The attack requires no user interaction and is reachable over the network, making it a credible threat to any deployment exposing the device's management interface. A public proof-of-concept exploit has been published on GitHub, and EPSS places this at the 87th percentile of exploitation likelihood despite a low raw CVSS 4.0 score of 2.1 - a signal worth noting against the mismatch.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 enables remote attackers with low-level credentials to execute arbitrary operating system commands via the fwUrl and magicid parameters of the recvUpgradeNewFw function within /cgi-bin/cstecgi.cgi. The firmware upgrade Setting Handler fails to sanitize user-supplied input before passing it to the underlying OS shell, exposing the device to command execution. A public proof-of-concept exploit is available on GitHub; while not yet listed in CISA KEV, the EPSS 87th-percentile ranking signals elevated real-world exploitation interest relative to the broader vulnerability landscape.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary shell commands by manipulating the FileName argument passed to the setUploadUserData function within the /cgi-bin/cstecgi.cgi Setting Handler. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the skill barrier for adversaries. While not listed in CISA KEV, the EPSS score of 2.95% at the 87th percentile signals real-world exploitation probability well above average, making this a higher practical risk than the CVSS 4.0 base score of 2.1 alone would suggest.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a network-adjacent authenticated attacker to execute arbitrary operating system commands by manipulating the FileName argument passed to the setUpgradeUboot function within the /cgi-bin/cstecgi.cgi Setting Handler. Publicly available exploit code exists, hosted on GitHub, making exploitation accessible to low-skilled attackers. No public exploit identified in CISA KEV at time of analysis, though the EPSS 87th percentile ranking signals elevated exploitation interest relative to the broader CVE population despite a low absolute probability of 2.95%.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a remote, low-privileged attacker to execute arbitrary operating system commands on the device by manipulating the plugin_version parameter in the setUnloadUserData function of /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit exists on GitHub, and the EPSS percentile (87th) indicates this CVE carries meaningfully higher exploitation likelihood than the majority of published vulnerabilities despite its low CVSS 4.0 base score of 2.1. No public exploit identified as actively exploited (CISA KEV), but POC availability on a network-accessible embedded device warrants prompt attention in exposed deployments.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary operating system commands by manipulating network diagnostic parameters in the device's CGI handler. The vulnerable function setNetworkDiag, reachable at /cgi-bin/cstecgi.cgi, passes attacker-controlled values for NetDiagHost, NetDiagPingNum, NetDiagPingSize, NetDiagPingTimeOut, and NetDiagTracertHop directly into OS command execution without sanitization. A public proof-of-concept exploit exists on GitHub; the EPSS score of 2.95% at the 87th percentile indicates elevated exploitation likelihood relative to the broader CVE population, though SSVC assessment rates the attack as not automatable.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a low-privileged remote attacker to execute arbitrary system commands on the device by manipulating the host_time argument passed to the NTPSyncWithHost function within the CGI-based Setting Handler. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation. Despite being an OS command injection - a class of vulnerability typically associated with high-severity scores - the vendor CVSS 4.0 score of 2.1 reflects unusually low impact ratings (VC:L/VI:L/VA:L) that security teams should independently verify, as the 87th-percentile EPSS score signals that this CVE's characteristics are consistent with real-world exploitation interest.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows a network-reachable, low-privilege authenticated attacker to execute arbitrary operating system commands by injecting shell metacharacters into the admuser or admpass arguments of the setPasswordCfg function within /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit has been published on GitHub, materially lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving affected deployments dependent on compensating controls.
OS command injection in Totolink CA750-PoE firmware 6.2c.510 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the webWlanIdx argument within the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. A publicly available proof-of-concept exploit hosted on GitHub exists, materially lowering the skill threshold for exploitation despite the low CVSS 4.0 score of 2.1. No public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), but EPSS places this at the 85th percentile, signaling elevated exploitation likelihood relative to the broader CVE population.
Command injection in Totolink WA300 firmware version 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the hostTime parameter in the NTPSyncWithHost function accessible through /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, though actual real-world exploitation risk is mitigated by the requirement for authenticated access and the low impact scope (limited to confidentiality, integrity, and availability of the application itself, with no system-wide impact).
Command injection in Totolink WA300 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the langType parameter in the setLanguageCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, though the low CVSS 2.1 score reflects limited scope (only low confidentiality and integrity impact, no system integrity or availability impact) and authentication requirement, reducing real-world attack surface.
Command injection in Totolink WA300 firmware version 5.2cu.7112_B20190227 allows authenticated remote attackers to execute arbitrary commands via the webWlanIdx parameter in the setWebWlanIdx function of /cgi-bin/cstecgi.cgi. The vulnerability requires valid user credentials but no user interaction, with publicly available exploit code demonstrating the attack.
External file inclusion in Totolink N300RH firmware 6.1c.1353_B20190305 allows remote unauthenticated attackers to manipulate the FileName parameter in the setUploadSetting function via /cgi-bin/cstecgi.cgi, enabling arbitrary file writes and denial of service. Publicly available exploit code exists, and the vulnerability carries a CVSS score of 6.5 reflecting network-accessible attack vector with low complexity.
Remote code execution in Totolink N300RH firmware 6.1c.1353_B20190305 allows unauthenticated network attackers to execute arbitrary OS commands via command injection in the FileName parameter of the setUpgradeUboot function in upgrade.so. Publicly available exploit code exists for this vulnerability, which carries a CVSS 6.9 score reflecting network-accessible attack vector with low complexity and no authentication requirements.
OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in the setGameSpeedCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists on GitHub (EPSS and KEV status not provided, but publicly available proof-of-concept increases immediate risk). Attack vector is network-based with low complexity requiring no user interaction or authentication (CVSS:3.1 AV:N/AC:L/PR:N/UI:N).
OS command injection in Totolink A7100RU router firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'provider' parameter in the setDdnsCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (GitHub POC) demonstrating practical exploitation. With CVSS 7.3 and network-accessible attack vector requiring no authentication or user interaction, this represents a significant risk to exposed devices, though no active exploitation confirmed by CISA KEV at time of analysis.
OS command injection in Totolink A3300R firmware version 17.0.0cu.557_B20221024 allows authenticated local attackers to execute arbitrary commands via the stun_pass parameter in the vsetTr069Cfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 5.1 (medium severity) with CVSS:4.0/AV:A/AC:L/PR:L vector indicating adjacent network access and low authentication requirements. Publicly available exploit code exists, though active exploitation status (CISA KEV) is not confirmed.
OS command injection in Totolink A7100RU firmware version 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary commands via manipulation of the mode parameter in the setScheduleCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists for this vulnerability, creating immediate risk for exposed devices.
Remote command injection in Totolink A7100RU firmware 7.4cu.2313_b20191024 allows unauthenticated attackers to execute arbitrary OS commands via manipulation of the resetFlags parameter in the CsteSystem function (/cgi-bin/cstecgi.cgi). Publicly available exploit code exists for this vulnerability, which achieves a CVSS 6.9 score with low confidentiality, integrity, and availability impact across multiple scopes.
Authentication bypass in Totolink A8000R 5.9c.681_B20180413 allows remote attackers to manipulate the langType parameter in the setLanguageCfg function at /cgi-bin/cstecgi.cgi to bypass authentication controls without credentials. This unauthenticated remote vulnerability has publicly available exploit code and poses a confirmed risk to exposed router management interfaces.
Command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the vlanPriLan3 parameter in the setIptvCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a publicly available exploit and carries moderate severity (CVSS 6.3) with confirmed exploitability signals (EPSS P/E indicator). Successful exploitation grants an authenticated attacker the ability to manipulate VLAN priority settings and potentially gain code execution on the affected router.
Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via manipulation of the rxRate parameter in the setWiFiBasicCfg function at /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 with publicly available exploit code, making it a moderate-priority issue for affected device administrators despite requiring prior authentication.
Command injection in Totolink A3300R router firmware 17.0.0cu.557_b20221024 allows unauthenticated remote attackers to execute arbitrary system commands via the setSyslogCfg function in /cgi-bin/cstecgi.cgi. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation. The CVSS vector (AV:N/AC:L/PR:N) confirms network-accessible exploitation with low complexity and no authentication required, enabling pre-authentication remote code execution on affected routers.
Command injection in Totolink A3300R firmware version 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via manipulation of the pptpPassThru parameter in the setVpnPassCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with network-accessible attack vector and low complexity; publicly available exploit code exists, making this an actionable threat for affected deployments.
Command injection in Totolink A3300R router firmware version 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via a crafted ip parameter in the setStaticRoute function of /cgi-bin/cstecgi.cgi. The vulnerability carries a CVSS score of 6.3 (medium severity) with public exploit code available, enabling potential compromise of router configuration and data integrity.
Remote command injection in Totolink A3300R firmware 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the enable parameter in the setUPnPCfg function at /cgi-bin/cstecgi.cgi. Publicly available exploit code exists, and the vulnerability has a CVSS score of 6.3 with confirmed proof-of-concept demonstrated on GitHub.
Command injection in Totolink A3300R 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary system commands via the qos_up_bw parameter in the setSmartQosCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with low attack complexity, and publicly available exploit code exists, though no active exploitation via CISA KEV has been confirmed at time of analysis.
Command injection in Totolink A3300R firmware versions up to 17.0.0cu.557_b20221024 allows authenticated remote attackers to execute arbitrary commands via the lanIp parameter in the setLanCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists for this vulnerability. With a CVSS score of 5.3 and moderate real-world exploitability, this presents a meaningful risk to affected router installations.
Command injection in Totolink NR1800X firmware 9.1.0u.6279_B20210910 allows authenticated remote attackers to execute arbitrary commands via the host_time parameter in the NTPSyncWithHost function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (medium severity) with publicly available exploit code, though it requires valid login credentials to exploit. Real-world risk is moderate given the authentication requirement and moderate EPSS probability (indicated by E:P in vector).
Command injection in Totolink A3600R firmware 4.1.2cu.5182_B20201102 allows authenticated remote attackers to execute arbitrary commands via the NoticeUrl parameter in the setNoticeCfg function of /cgi-bin/cstecgi.cgi. The vulnerability has a CVSS score of 6.3 (low-to-medium severity) but is confirmed by publicly available exploit code, making it an active threat to deployed devices despite the authentication requirement.
A critical OS command injection vulnerability exists in Totolink WA300 router firmware version 5.2cu.7112_B20190227, specifically in the recvUpgradeNewFw function within /cgi-bin/cstecgi.cgi. An unauthenticated remote attacker can exploit this flaw to execute arbitrary operating system commands on the affected device. A public proof-of-concept exploit has been released on GitHub, significantly lowering the barrier to exploitation and increasing real-world risk.
OS command injection in Totolink N300RH firmware allows unauthenticated remote attackers to execute arbitrary commands through the setWiFiWpsConfig function in the CGI handler. Public exploit code exists for this vulnerability, and no patch is currently available. Affected users should restrict network access to the device's management interface until a fix is released.
X5000R Firmware versions up to 9.1.0cu.2415_b20250515 is affected by uncontrolled resource consumption (CVSS 7.5).
X6000R Firmware versions up to 9.4.0cu.1498_b20250826 is affected by os command injection (CVSS 8.8).
Argument injection in TOTOLINK X5000R router v9.1.0cu via setDiagnosisCfg handler allows unauthenticated remote code execution. EPSS 2.0% with PoC available.
X5000R Firmware versions up to 9.1.0cu.2415_b20250515 is affected by os command injection (CVSS 8.0).
OS command injection in Totolik WA300 firmware via the setAPNetwork function allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw affects firmware version 5.2cu.7112_B20190227 and impacts the /cgi-bin/cstecgi.cgi endpoint through manipulation of the Ipaddr parameter.