Cp900 Firmware vulnerabilities

7 known vulnerabilities in Cp900 Firmware from TOTOLINK. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  CP900: Improper Neutralization of Special Elements used in a Command

  CVE-2024-7464Aug 5, 2024TOTOLINKEPSS 19.9%

  A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The manipulation of the argument telnet_enabled leads to command injection. The attack m

• 9.8 Critical severity

  CP900: Buffer Copy without Checking Size of Input

  CVE-2024-7463Aug 5, 2024TOTOLINKEPSS 11%

  A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack can be initiate

• 9.8 Critical severity

  Cp900 Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-28495Mar 24, 2023TOTOLINKEPSS 2.44%

  TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

• 9.8 Critical severity

  Cp900 Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2022-28496Mar 23, 2023TOTOLINKEPSS 1.36%

  TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted requ

• 9.8 Critical severity

  Cp900 Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2022-28497Mar 23, 2023TOTOLINKEPSS 1.36%

  TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

• 9.8 Critical severity

  Cp900 Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-28491Mar 23, 2023TOTOLINKEPSS 4.66%

  TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

• 9.8 Critical severity

  Cp900 Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-28494Mar 23, 2023TOTOLINKEPSS 2.55%

  TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.