TOTOLINK vulnerabilities
We track 806 vulnerabilities in TOTOLINK products across 60+ products. 806 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.
Latest TOTOLINK vulnerabilities
- 7.5 High severity
x5000r_firmware: Out-of-bounds Read
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the command field.
- 9.8 Critical severity
x5000r_firmware: Buffer Copy without Checking Size of Input
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the IP field.
- 8.8 High severity
X6000R: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.852_20230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi of the component Web Interface. The manipulation of the argument http_ho
- 9.8 Critical severity
X6000R AX3000: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The exp
- 7.5 High severity
X5000r Firmware: Improper Neutralization of Special Elements used in an OS Command
An issue in TOTOLINK X5000R V.9.1.0u.6369_B20230113 allows a remote attacker to cause a denial of service via the host_time parameter of the NTPSyncWithHost component.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg function.
- 9.8 Critical severity
a3300r: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.
- 9.8 Critical severity
a3300r_firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function.
- 9.8 Critical severity
a3300r_firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules function.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function.
- 7.2 High severity
N200RE: Stack-based Buffer Overflow
A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument http_host leads to stack-based buffer overflow. It is
- 8.8 High severity
N200RE: Stack-based Buffer Overflow
A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffe
- 8.8 High severity
N200RE: Stack-based Buffer Overflow
A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ePort leads to stack-based buffer
- 9.8 Critical severity
N200RE: Stack-based Buffer Overflow
A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cstecgi.cgi. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely.
- 8.8 High severity
N200RE: Out-of-bounds Write
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to stack-based buffer overflow.
- 8.8 High severity
N200RE: Stack-based Buffer Overflow
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument eTime leads to stack-based buffer
- 8.8 High severity
N200RE: Stack-based Buffer Overflow
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buffer overflow. It is
- 8.8 High severity
N200RE: Stack-based Buffer Overflow
A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. Affected by this issue is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow
- 9.8 Critical severity
x6000r_firmware: Improper Neutralization of Special Elements used in a Command
An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lang' parameter.
- 9.8 Critical severity
X2000R: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical was found in Totolink X2000R 1.0.0-B20221212.1452. Affected by this vulnerability is the function formMapDelDevice of the file /boafrm/formMapDelDevice. The manipulation of the argument macstr leads to command injection.
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to stack-based buffer overflow. It is po
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been rated as critical. This issue affects the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang leads to stack-based buffer overflow. Th
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been declared as critical. This vulnerability affects the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument sPort leads to stack-based b
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130. It has been classified as critical. This affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to stack-based buffer overflow
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability was found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this issue is the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument sTime leads to stack-based buffer overfl
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability has been found in Totolink LR1200GB 9.1.0u.6619_B20230130 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to stack-based buff
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability, which was classified as critical, was found in Totolink LR1200GB 9.1.0u.6619_B20230130. Affected is the function setOpModeCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument pppoeUser leads to stack-based buffer overflow. It
- 9.8 Critical severity
LR1200GB: Stack-based Buffer Overflow
A vulnerability, which was classified as critical, has been found in Totolink LR1200GB 9.1.0u.6619_B20230130. This issue affects the function setSmsCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument text leads to stack-based buffer overflow
- 9.1 Critical severity
N350RT: Missing Authorization
A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation leads to improper access controls. The attack can be in
- 9.1 Critical severity
T8: Missing Authorization
A vulnerability classified as problematic has been found in Totolink T8 4.1.5cu.833_20220905. This affects the function getSysStatusCfg of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument ssid/key leads to inform
- 9.8 Critical severity
ex1800t: Improper Neutralization of Special Elements used in an OS Command
TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled parameter of the setTelnetCfg interface
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function.
- 9.8 Critical severity
a3300r_firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function.
- 9.8 Critical severity
A3300r Firmware: Improper Neutralization of Special Elements used in an OS Command
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function.