N600R vulnerabilities

6 known vulnerabilities in N600R from TOTOLINK. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.3 High severity

  N600R: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-79912Aug 25, 2026TOTOLINKEPSS 2.11%

  A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument ntp_server results in command injection. The attack can be in

• 10.0 Critical severity

  N600R: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2026-79911Aug 25, 2026TOTOLINKEPSS 1.1%

  A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument Hostname leads to stack-b

• 8.8 High severity

  N600R: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2025-11444Oct 8, 2025TOTOLINKEPSS 1.06%

  A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to bu

• 9.8 Critical severity

  N600R: Improper Neutralization of Special Elements used in a Command

  CVE-2025-9935Sep 4, 2025TOTOLINKEPSS 2.73%

  A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. Th

• 7.2 High severity

  N600R: Incorrect Privilege Assignment

  CVE-2025-8181Jul 26, 2025TOTOLINKEPSS 1.12%

  A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiat

• 9.8 Critical severity

  T10: Buffer Copy without Checking Size of Input

  CVE-2025-4496May 10, 2025TOTOLINKEPSS 1.25%

  A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation