A950rg Firmware vulnerabilities

29 known vulnerabilities in A950rg Firmware from TOTOLINK. 29 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

29vulnerabilities

21critical

8high

0exploited

9.1average CVSS score

Latest first

9.8 Critical severity
A950rg Firmware: Buffer Copy without Checking Size of Input
CVE-2025-67188Feb 3, 2026TOTOLINK
A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg interface of the /lib/cste_modules/ipv6.so module. The function fails to properly validate the length of the user-controlled radvdinterfacen
9.8 Critical severity
A950rg Firmware: Stack-based Buffer Overflow
CVE-2025-67187Feb 3, 2026TOTOLINK
A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules interface of /lib/cste_modules/firewall.so where the comment parameter is not properly validated for length.
9.8 Critical severity
A950rg Firmware: Buffer Copy without Checking Size of Input
CVE-2025-67186Feb 3, 2026TOTOLINK
TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so. The vulnerability occurs because the `url` parameter is not properly validated for length, allowing remote att
9.8 Critical severity
A7100ru Firmware: Incorrect Privilege Assignment
CVE-2025-44655Jul 21, 2025TOTOLINK
In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal networ
9.8 Critical severity
T10: Buffer Copy without Checking Size of Input
CVE-2025-4496May 10, 2025TOTOLINKEPSS 1.25%
A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation
9.8 Critical severity
A950rg Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2025-45798May 8, 2025TOTOLINKEPSS 1.36%
A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the /lib/cste_modules/system.so library, specifically in the processing of the IpTo parameter.
9.8 Critical severity
A950rg Firmware: Out-of-bounds Write
CVE-2025-45797May 8, 2025TOTOLINKEPSS 18.3%
TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the NoticeUrl parameter in the setNoticeCfg interface of /lib/cste_modules/system.so.
9.8 Critical severity
A950rg Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2025-45800May 2, 2025TOTOLINK
TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, specifically in the processing of the deviceMac parameter.
7.3 High severity
A830r Firmware: Buffer Copy without Checking Size of Input
CVE-2025-28028Apr 23, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter.
7.3 High severity
A830r Firmware: Buffer Copy without Checking Size of Input
CVE-2025-28025Apr 23, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
9.8 Critical severity
A950rg Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28036Apr 22, 2025TOTOLINKEPSS 1.36%
TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28035Apr 22, 2025TOTOLINKEPSS 1.36%
TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
7.3 High severity
A830r Firmware: Stack-based Buffer Overflow
CVE-2025-28029Apr 22, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi
7.3 High severity
A830r Firmware: Stack-based Buffer Overflow
CVE-2025-28027Apr 22, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
7.3 High severity
A830r Firmware: Stack-based Buffer Overflow
CVE-2025-28026Apr 22, 2025TOTOLINK
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi.
9.8 Critical severity
A810r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28037Apr 22, 2025TOTOLINKEPSS 1.23%
TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter.
9.8 Critical severity
A800r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-28034Apr 22, 2025TOTOLINKEPSS 1.36%
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth remote command execution vul
7.3 High severity
A800r Firmware: Stack-based Buffer Overflow
CVE-2025-28033Apr 22, 2025TOTOLINK
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerabilit
7.3 High severity
A800r Firmware: Stack-based Buffer Overflow
CVE-2025-28032Apr 22, 2025TOTOLINK
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNo
7.2 High severity
A830r Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-28935Jul 6, 2022TOTOLINKEPSS 3.3%
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to cont
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26214Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26212Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26211Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26210Mar 15, 2022TOTOLINKEPSS 5.69%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26209Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26208Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26207Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26206Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A950rg Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25082Feb 24, 2022TOTOLINKEPSS 13.7%
TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.