38
CVEs
9
Critical
20
High
0
KEV
18
PoC
29
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
9
HIGH
20
MEDIUM
6
LOW
3
Monthly CVE Trend
Affected Products (30)
X5000r Firmware
63
A3002r Firmware
61
X6000r Firmware
50
A3100R Firmware
45
A3700r Firmware
43
X2000r Firmware
41
A8000Ru
40
A3002ru Firmware
40
A7100Ru
37
T6 Firmware
34
A950rg Firmware
33
N600r Firmware
32
A7000r Firmware
31
A7100Ru Firmware
30
A810R Firmware
29
Lr350 Firmware
28
Ex1800T Firmware
28
Ex1200t Firmware
27
Nr1800x Firmware
26
A3300R Firmware
26
T8 Firmware
26
A3000Ru Firmware
25
Ca300 Poe Firmware
24
A3600r Firmware
23
A800R Firmware
23
A702r Firmware
22
T10 Firmware
21
A720R Firmware
21
N350Rt Firmware
20
X15 Firmware
20
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-79911 | Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact. | CRITICAL | 9.3 | 0.6% | 67 |
PoC
No patch
|
| CVE-2026-15701 | Stack-based buffer overflow in the Totolink NR1800X router (firmware 9.1.0u.6279_B20210910) lets remote attackers corrupt memory by supplying an oversized HTTP Host header to the Form_Logout handler at /formLogout.htm, served by the embedded lighttpd web interface. Because the flaw is reachable over the network without authentication and publicly available exploit code exists, it is a strong candidate for opportunistic exploitation despite not yet appearing in CISA KEV. Successful exploitation can crash the device or, given the CWE-121 stack overwrite, potentially achieve code execution on the router. | HIGH | 8.9 | 0.8% | 64 |
PoC
No patch
|
| CVE-2026-90608 | Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis. | HIGH | 8.6 | 0.8% | 64 |
PoC
No patch
|
| CVE-2026-82616 | Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch. | HIGH | 8.6 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-90607 | Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-82539 | Memory corruption in TOTOLINK A720R router firmware 4.1.5cu.630_B20250509 allows authenticated remote attackers to trigger a buffer overflow in the MAC filtering subsystem, with potential for arbitrary code execution. The vulnerable path is the `setMacFilterRules` function within `cstecgi.cgi`, exploitable by sending a crafted `desc` argument over the network. A public proof-of-concept is available on GitHub; no CISA KEV listing exists at time of analysis, but the combination of network reachability and published exploit code meaningfully elevates real-world risk. | HIGH | 8.5 | 0.6% | 63 |
PoC
No patch
|
| CVE-2026-19847 | Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required. | HIGH | 7.4 | 0.6% | 58 |
PoC
No patch
|
| CVE-2026-19812 | Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-19811 | Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-19814 | Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-19815 | Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-19846 | Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis. | HIGH | 7.4 | 0.5% | 57 |
PoC
No patch
|
| CVE-2026-51686 | Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-51705 | Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-51733 | Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|