N600r Firmware vulnerabilities

18 known vulnerabilities in N600r Firmware from TOTOLINK. 18 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

18vulnerabilities

12critical

6high

0exploited

9.1average CVSS score

Latest first

7.5 High severity
N600r Firmware: NULL Pointer Dereference
CVE-2025-60336Oct 22, 2025TOTOLINKEPSS 1.77%
A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
7.5 High severity
N600r Firmware: NULL Pointer Dereference
CVE-2025-60335Oct 22, 2025TOTOLINKEPSS 2.13%
A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
7.5 High severity
N600r Firmware: Stack-based Buffer Overflow
CVE-2025-60334Oct 22, 2025TOTOLINK
TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
7.5 High severity
N600r Firmware: Stack-based Buffer Overflow
CVE-2025-60333Oct 22, 2025TOTOLINK
TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
8.8 High severity
N600R: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2025-11444Oct 8, 2025TOTOLINKEPSS 1.06%
A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to bu
9.8 Critical severity
N600R: Improper Neutralization of Special Elements used in a Command
CVE-2025-9935Sep 4, 2025TOTOLINKEPSS 2.73%
A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. Th
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2025-51390Aug 4, 2025TOTOLINKEPSS 1.76%
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.
7.2 High severity
N600R: Incorrect Privilege Assignment
CVE-2025-8181Jul 26, 2025TOTOLINKEPSS 1.12%
A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiat
9.8 Critical severity
N600r Firmware: Buffer Copy without Checking Size of Input
CVE-2025-46060Jun 13, 2025TOTOLINKEPSS 1.04%
Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component
9.8 Critical severity
T10: Buffer Copy without Checking Size of Input
CVE-2025-4496May 10, 2025TOTOLINKEPSS 1.25%
A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28913May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28911May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28910May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28909May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28908May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28907May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28906May 10, 2022TOTOLINKEPSS 2.87%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28905May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName.