29
CVEs
8
Critical
12
High
0
KEV
11
PoC
20
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
8
HIGH
12
MEDIUM
6
LOW
3
Monthly CVE Trend
Affected Products (30)
X5000r Firmware
63
A3002r Firmware
61
X6000r Firmware
50
A3100R Firmware
45
A3700r Firmware
43
X2000r Firmware
41
A8000Ru
40
A3002ru Firmware
40
A7100Ru
37
T6 Firmware
34
A950rg Firmware
33
N600r Firmware
32
A7000r Firmware
31
A7100Ru Firmware
30
A810R Firmware
29
Lr350 Firmware
28
Ex1800T Firmware
28
Ex1200t Firmware
27
Nr1800x Firmware
26
A3300R Firmware
26
T8 Firmware
26
A3000Ru Firmware
25
Ca300 Poe Firmware
24
A3600r Firmware
23
A800R Firmware
23
A702r Firmware
22
T10 Firmware
21
A720R Firmware
21
N350Rt Firmware
20
X15 Firmware
20
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-79911 | Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact. | CRITICAL | 9.3 | 0.6% | 67 |
PoC
No patch
|
| CVE-2026-90608 | Buffer overflow in TOTOLINK A3002MU router firmware version Hh-B20211125.1046 allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by supplying an oversized value to the `service_type` argument of the `formPortFw` CGI handler in the boa embedded web server. The vulnerability is reachable over the network and a proof-of-concept exploit has been publicly published on GitHub. No vendor-released patch has been confirmed at time of analysis. | HIGH | 8.6 | 0.8% | 64 |
PoC
No patch
|
| CVE-2026-82616 | Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch. | HIGH | 8.6 | 0.6% | 64 |
PoC
No patch
|
| CVE-2026-90607 | Stack-based buffer overflow in the Totolink A3002MU router's boa HTTP server allows a network-adjacent authenticated attacker to overwrite memory via an oversized `submit-url` argument submitted to the `formNewSchedule` handler at `/boafrm/formNewSchedule`, likely yielding arbitrary code execution on the device. The affected firmware version is Hh-B20211125.1046. A public proof-of-concept exploit exists on GitHub, raising the realistic exploitation probability for devices reachable from the network with default or known credentials. No vendor patch has been identified at time of analysis. | HIGH | 8.6 | 0.5% | 63 |
PoC
No patch
|
| CVE-2026-82539 | Memory corruption in TOTOLINK A720R router firmware 4.1.5cu.630_B20250509 allows authenticated remote attackers to trigger a buffer overflow in the MAC filtering subsystem, with potential for arbitrary code execution. The vulnerable path is the `setMacFilterRules` function within `cstecgi.cgi`, exploitable by sending a crafted `desc` argument over the network. A public proof-of-concept is available on GitHub; no CISA KEV listing exists at time of analysis, but the combination of network reachability and published exploit code meaningfully elevates real-world risk. | HIGH | 8.5 | 0.6% | 63 |
PoC
No patch
|
| CVE-2026-51686 | Unauthenticated wireless-network reconfiguration in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter or disable Wi-Fi settings by sending a crafted POST request to the setWiFiEasyCfg handler in /cgi-bin/cstecgi.cgi, which performs no access-control check. Any attacker able to reach the device's web interface can degrade or take down wireless connectivity and weaken Wi-Fi security parameters. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and there is no evidence of active exploitation. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-51705 | Unauthenticated configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiMeshName handler via a crafted POST to /cgi-bin/cstecgi.cgi with no credentials, renaming mesh network entries. The setter enforces no access control (CWE-284), so any host that can reach the web management interface can alter mesh labels. No public exploit is identified at time of analysis and EPSS is low (0.18%), consistent with a low-value config write rather than a device-takeover primitive. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-51733 | Unauthenticated configuration tampering in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 lets remote attackers delete Wi-Fi schedule entries by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The affected handler (labeled 'FirmwareUpgrade' in the advisory, though the observed effect is removal of Wi-Fi schedule rules) performs no access-control check. No public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile), consistent with an obscure consumer-router flaw rather than one under broad exploitation. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-51765 | Incorrect access control in the recvIndirectMeshInfo function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers insert or replace mesh neighbor records by sending a crafted MQTT message to the cs_broker component. The CVSS 9.8 rating reflects an unauthenticated network-facing vector, but the primary real impact is integrity (poisoning of the mesh neighbor table), with no confidentiality read and only indirect availability effect. No public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile). | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-51754 | Unauthenticated state tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite the mesh slave-IP inventory by publishing a crafted MQTT message to the cs_broker component, which performs no access control on the updateSlaveIpList function. Any attacker able to reach the MQTT broker can corrupt the router's internal record of mesh slave device addresses, disrupting mesh coordination. No public exploit has been identified and EPSS is low (0.17%), but the flaw is unauthenticated and MITRE-reported. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-51715 | Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers delete MAC address filter rules by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint's delMacFilterRules function. Because no authentication is required, an attacker on the network path can silently strip a device-access control layer, potentially allowing previously blocked/rogue devices onto the LAN. No public exploit identified at time of analysis, and the EPSS score is very low (0.16%, 6th percentile) despite the headline 9.8 CVSS. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-79912 | Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ntp_server` parameter to the `getCurrentTime` handler at `/cgi-bin/cstecgi.cgi`. A public proof-of-concept demonstrating popen-based injection is available on GitHub, confirmed by the CVSS 4.0 E:P exploit maturity indicator, meaning exploitation requires minimal attacker skill. No vendor-released patch has been identified in available intelligence, leaving internet-exposed devices unmitigated. | MEDIUM | 5.5 | 1.4% | 49 |
PoC
No patch
|
| CVE-2026-75013 | Denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows authenticated remote attackers to crash the device by sending a crafted request to the setWizardCfg function in /cgi-bin/cstecgi.cgi, triggering a null pointer dereference. Impact is limited strictly to availability - no confidentiality or integrity compromise - but a publicly available proof-of-concept exploit on GitHub (CVSS 4.0 E:P) significantly lowers the exploitation barrier. No vendor patch has been identified and the device is not listed in CISA KEV, making access restriction to the management interface the primary mitigation. | MEDIUM | 5.7 | 0.4% | 49 |
PoC
No patch
|
| CVE-2026-75012 | Remote denial-of-service in TOTOLINK EX1200L firmware 9.3.5u.6146_B20201023 allows a low-privileged authenticated attacker to crash the device by submitting a malformed request to the setPasswordCfg function in the CGI-based web management interface. Exploitation triggers a null pointer dereference in /cgi-bin/cstecgi.cgi, rendering the device unresponsive and disrupting its network extension services entirely. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation, though no active exploitation has been recorded in CISA KEV at time of analysis. | MEDIUM | 5.7 | 0.4% | 49 |
PoC
No patch
|
| CVE-2026-51690 | Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV. | CRITICAL | 9.1 | 0.2% | 46 |
No patch
|