N350rt Firmware vulnerabilities

15 known vulnerabilities in N350rt Firmware from TOTOLINK. 15 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  n350rt_firmware: Incorrect Authorization

  CVE-2024-42966Aug 15, 2024TOTOLINK

  Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.

• 9.8 Critical severity

  N350RT: Buffer Copy without Checking Size of Input

  CVE-2024-7462Aug 5, 2024TOTOLINKEPSS 1.35%

  A vulnerability classified as critical has been found in TOTOLINK N350RT 9.3.5u.6139_B20201216. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to buffer overflow. It is possible to initiate

• 8.8 High severity

  N350RT: Buffer Copy without Checking Size of Input

  CVE-2024-7333Aug 1, 2024TOTOLINKEPSS 1.24%

  A vulnerability was found in TOTOLINK N350RT 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument week/sTime/eTime leads to buffer o

• 9.1 Critical severity

  N350RT: Missing Authorization

  CVE-2024-0570Jan 16, 2024TOTOLINK

  A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation leads to improper access controls. The attack can be in

• 9.8 Critical severity

  N350RT: Stack-based Buffer Overflow

  CVE-2023-7219Jan 9, 2024TOTOLINKEPSS 1.3%

  A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer

• 7.2 High severity

  N350RT: Stack-based Buffer Overflow

  CVE-2023-7218Jan 8, 2024TOTOLINKEPSS 1.27%

  A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to stack-based buffer overflow. It is poss

• 8.8 High severity

  N350RT: Out-of-bounds Write

  CVE-2023-7214Jan 7, 2024TOTOLINK

  A vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation o

• 8.8 High severity

  N350RT: Out-of-bounds Write

  CVE-2023-7213Jan 7, 2024TOTOLINK

  A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function main of the file /cgi-bin/cstecgi.cgi?action=login&flag=1 of the component HTTP POST Request Handler. The manipulation of

• 8.8 High severity

  N350RT: Stack-based Buffer Overflow

  CVE-2023-7187Dec 31, 2023TOTOLINK

  A vulnerability was found in Totolink N350RT 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi?action=login&flag=ie8 of the component HTTP POST Request Handler. The manipulation le

• 7.8 High severity

  N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-36487Aug 25, 2022TOTOLINKEPSS 1.02%

  TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg.

• 7.8 High severity

  N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-36486Aug 25, 2022TOTOLINKEPSS 1.02%

  TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.

• 7.8 High severity

  N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-36485Aug 25, 2022TOTOLINKEPSS 1.02%

  TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.

• 7.8 High severity

  N350rt Firmware: Out-of-bounds Write

  CVE-2022-36482Aug 25, 2022TOTOLINK

  TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the lang parameter in the function setLanguageCfg.

• 7.8 High severity

  N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-36481Aug 25, 2022TOTOLINKEPSS 1.22%

  TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the ip parameter in the function setDiagnosisCfg.

• 7.8 High severity

  N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-36479Aug 25, 2022TOTOLINKEPSS 1.02%

  TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost.