A3100r Firmware vulnerabilities

32 known vulnerabilities in A3100r Firmware from TOTOLINK. 32 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

32vulnerabilities

16critical

16high

0exploited

8.7average CVSS score

Latest first

9.8 Critical severity
T10: Buffer Copy without Checking Size of Input
CVE-2025-4496May 10, 2025TOTOLINKEPSS 1.25%
A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation
7.3 High severity
A830r Firmware: Buffer Copy without Checking Size of Input
CVE-2025-28028Apr 23, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter.
7.3 High severity
A830r Firmware: Buffer Copy without Checking Size of Input
CVE-2025-28025Apr 23, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
9.8 Critical severity
A950rg Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28036Apr 22, 2025TOTOLINKEPSS 1.36%
TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28035Apr 22, 2025TOTOLINKEPSS 1.36%
TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
7.3 High severity
A830r Firmware: Stack-based Buffer Overflow
CVE-2025-28029Apr 22, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi
7.3 High severity
A830r Firmware: Stack-based Buffer Overflow
CVE-2025-28027Apr 22, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
7.3 High severity
A830r Firmware: Stack-based Buffer Overflow
CVE-2025-28026Apr 22, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi.
9.8 Critical severity
A800r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28034Apr 22, 2025TOTOLINKEPSS 1.36%
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth remote command execution vul
7.3 High severity
A800r Firmware: Stack-based Buffer Overflow
CVE-2025-28033Apr 22, 2025TOTOLINK
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerabilit
7.3 High severity
A800r Firmware: Stack-based Buffer Overflow
CVE-2025-28032Apr 22, 2025TOTOLINK
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNo
9.8 Critical severity
A3100r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28256Mar 28, 2025TOTOLINK
An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wireless.so.
8.8 High severity
A3100R: Improper Neutralization of Special Elements used in a Command
CVE-2024-7158Jul 28, 2024TOTOLINKEPSS 3.09%
A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the arg
8.8 High severity
A3100R: Buffer Copy without Checking Size of Input
CVE-2024-7157Jul 28, 2024TOTOLINKEPSS 7.37%
A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument http_host leads to buffer ov
7.5 High severity
a3100r: Buffer Copy without Checking Size of Input
CVE-2024-36650Jun 11, 2024TOTOLINK
TOTOLINK AC1200 Wireless Dual Band Gigabit Router firmware A3100R V4.1.2cu.5247_B20211129, in the cgi function `setNoticeCfg` of the file `/lib/cste_modules/system.so`, the length of the user input string `NoticeUrl` is not checked. This can lead to a buffer o
7.2 High severity
A830r Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-28935Jul 6, 2022TOTOLINKEPSS 3.3%
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to cont
9.8 Critical severity
A3100r Firmware: Use of Hard-coded Credentials
CVE-2022-29645May 18, 2022TOTOLINKEPSS 1.47%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shadow.sample.
9.8 Critical severity
A3100r Firmware: Use of Hard-coded Credentials
CVE-2022-29644May 18, 2022TOTOLINKEPSS 1.6%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the component /web_cste/cgi-bin/product.ini.
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29643May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter in the function setMacQos. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST re
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29642May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST r
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29641May 18, 2022TOTOLINKEPSS 1.19%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) vi
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29640May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29638May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST r
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26214Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26212Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26211Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26210Mar 15, 2022TOTOLINKEPSS 5.69%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26209Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26208Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26207Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26206Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A3100r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25077Feb 24, 2022TOTOLINKEPSS 30.4%
TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.