212
CVEs
20
Critical
126
High
0
KEV
187
PoC
146
Unpatched C/H
0.0%
Patch Rate
1.4%
Avg EPSS
Severity Breakdown
CRITICAL
20
HIGH
126
MEDIUM
28
LOW
38
Monthly CVE Trend
Affected Products (30)
X5000r Firmware
63
A3002r Firmware
61
X6000r Firmware
50
A3100R Firmware
45
A3700r Firmware
43
X2000r Firmware
41
A8000Ru
40
A3002ru Firmware
40
A7100Ru
37
T6 Firmware
34
A950rg Firmware
33
N600r Firmware
32
A7000r Firmware
31
A7100Ru Firmware
30
A810R Firmware
29
Lr350 Firmware
28
Ex1800T Firmware
28
Ex1200t Firmware
27
Nr1800x Firmware
26
A3300R Firmware
26
T8 Firmware
26
A3000Ru Firmware
25
Ca300 Poe Firmware
24
A3600r Firmware
23
A800R Firmware
23
A702r Firmware
22
T10 Firmware
21
A720R Firmware
21
N350Rt Firmware
20
X15 Firmware
20
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-52053 | TOTOLINK X6000R router firmware V9.4.0cu.1360_B20241207 contains an unauthenticated command injection in the sub_417D74 function via the file_name parameter. Remote attackers can execute arbitrary commands on the router without authentication through crafted HTTP requests. | CRITICAL | 9.8 | 66.1% | 135 |
PoC
No patch
|
| CVE-2026-3301 | Command injection in TOTOLINK N300RH router firmware 6.1c.1353 via setDiagnosisCfg handler. EPSS 4.0% with PoC available — high exploitation probability for consumer routers. | CRITICAL | 9.8 | 4.0% | 73 |
PoC
No patch
|
| CVE-2025-61045 | Command injection in TOTOLINK X18 via mac parameter. EPSS 3.4%. PoC available. | CRITICAL | 9.8 | 3.4% | 72 |
PoC
No patch
|
| CVE-2025-61044 | Command injection in TOTOLINK X18 via agentName in setEasyMeshAgentCfg. EPSS 2.7%. PoC available. | CRITICAL | 9.8 | 2.7% | 72 |
PoC
No patch
|
| CVE-2025-70327 | Argument injection in TOTOLINK X5000R router v9.1.0cu via setDiagnosisCfg handler allows unauthenticated remote code execution. EPSS 2.0% with PoC available. | CRITICAL | 9.8 | 2.0% | 71 |
PoC
No patch
|
| CVE-2025-67186 | TOTOLINK A950RG router firmware has a buffer overflow in setUrlFilterRules that allows remote attackers to execute code through the router's management interface. | CRITICAL | 9.8 | 0.8% | 70 |
PoC
No patch
|
| CVE-2025-67188 | TOTOLINK A950RG has a third buffer overflow in setRadvdCfg providing yet another RCE vector through the router's IPv6 configuration interface. | CRITICAL | 9.8 | 0.6% | 70 |
PoC
No patch
|
| CVE-2025-67187 | TOTOLINK A950RG has a stack-based buffer overflow in a second endpoint, providing an additional RCE vector through the router's CGI interface. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2026-79911 | Stack-based buffer overflow in the TOTOLINK N600R router (firmware 4.3.0cu.7647_B20210106) lets remote attackers corrupt memory by supplying an oversized Hostname argument to the setSystemConfig function in /cgi-bin/cstecgi.cgi, potentially enabling arbitrary code execution on the device. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though the flaw is not listed in CISA KEV. VulDB scores it CVSS 4.0 9.3 (Critical), reflecting high confidentiality, integrity, and availability impact. | CRITICAL | 9.3 | 0.6% | 67 |
PoC
No patch
|
| CVE-2025-70328 | X6000R Firmware versions up to 9.4.0cu.1498_b20250826 is affected by os command injection (CVSS 8.8). | HIGH | 8.8 | 2.9% | 67 |
PoC
No patch
|
| CVE-2026-9436 | OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating system commands by manipulating the 'enable' argument passed to the setL2tpServerCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published on GitHub), though EPSS probability remains modest at 0.94% (76th percentile), and the issue is not currently listed in CISA KEV. | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|
| CVE-2026-5850 | OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the pptpPassThru parameter in setVpnPassCfg function of /cgi-bin/cstecgi.cgi. Exploitation requires no user interaction and achieves full system compromise (confidentiality, integrity, availability). Publicly available exploit code exists. Attack vector is network-accessible without authentication (CVSS 8.9 Critical). | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|
| CVE-2026-5851 | OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 allows unauthenticated remote attackers to execute arbitrary system commands via the 'enable' parameter in setUPnPCfg function within /cgi-bin/cstecgi.cgi. Publicly available exploit code exists. No vendor-released patch identified at time of analysis. CVSS 8.9 (Critical) reflects network-accessible attack requiring no user interaction. | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|
| CVE-2026-5852 | Unauthenticated remote OS command injection in Totolink A7100RU router firmware 7.4cu.2313_b20191024 enables complete system compromise via the setIptvCfg function in /cgi-bin/cstecgi.cgi. Attackers inject malicious commands through the igmpVer parameter without authentication, achieving arbitrary code execution with router privileges. CVSS 9.8 (Critical). Publicly available exploit code exists. No authentication, network-accessible attack vector with low complexity allows immediate weaponization for botnet recruitment, credential theft, or lateral network movement. | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|
| CVE-2026-5853 | OS command injection in Totolink A7100RU router version 7.4cu.2313_b20191024 enables unauthenticated remote attackers to execute arbitrary system commands via crafted addrPrefixLen parameter in setIpv6LanCfg function of /cgi-bin/cstecgi.cgi CGI handler. CVSS 9.8 critical severity reflects network-accessible attack vector requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. Publicly available exploit code exists. | HIGH | 8.9 | 0.9% | 65 |
PoC
No patch
|