TOTOLINK vulnerabilities

We track 806 vulnerabilities in TOTOLINK products across 60+ products. 806 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.

806vulnerabilities

451critical

355high

0exploited

9.2average CVSS score

Latest TOTOLINK vulnerabilities

9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-29801Apr 14, 2023TOTOLINKEPSS 2.01%
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.
9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-29800Apr 14, 2023TOTOLINKEPSS 2.01%
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-29799Apr 14, 2023TOTOLINKEPSS 2.01%
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-29798Apr 14, 2023TOTOLINKEPSS 2.01%
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-26978Apr 7, 2023TOTOLINKEPSS 1.92%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-26848Apr 7, 2023TOTOLINKEPSS 1.92%
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-27232Mar 28, 2023TOTOLINKEPSS 1.92%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.
9.8 Critical severity
Cp900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28495Mar 24, 2023TOTOLINKEPSS 2.44%
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
9.8 Critical severity
Cp900 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-28496Mar 23, 2023TOTOLINKEPSS 1.36%
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability allows attackers to execute arbitrary commands via a crafted requ
9.8 Critical severity
Cp900 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-28497Mar 23, 2023TOTOLINKEPSS 1.36%
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
9.8 Critical severity
Cp900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28491Mar 23, 2023TOTOLINKEPSS 4.66%
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
9.8 Critical severity
Cp900 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28494Mar 23, 2023TOTOLINKEPSS 2.55%
TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2023-25395Mar 8, 2023TOTOLINKEPSS 1.92%
TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/delStaticDhcpRules.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24238Feb 16, 2023TOTOLINKEPSS 1.92%
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24236Feb 16, 2023TOTOLINKEPSS 1.92%
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24276Feb 6, 2023TOTOLINKEPSS 1.92%
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24157Feb 3, 2023TOTOLINKEPSS 2.13%
A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24156Feb 3, 2023TOTOLINKEPSS 2.13%
A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
9.8 Critical severity
T8 Firmware: Use of Hard-coded Credentials
CVE-2023-24155Feb 3, 2023TOTOLINK
TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bin/product.ini.
9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24153Feb 3, 2023TOTOLINKEPSS 2.13%
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24152Feb 3, 2023TOTOLINKEPSS 2.13%
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24151Feb 3, 2023TOTOLINKEPSS 2.13%
A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24150Feb 3, 2023TOTOLINKEPSS 2.1%
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24148Feb 3, 2023TOTOLINKEPSS 1.82%
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
7.5 High severity
Ca300-poe Firmware: Use of Hard-coded Credentials
CVE-2023-24147Feb 3, 2023TOTOLINK
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.
9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24145Feb 3, 2023TOTOLINKEPSS 1.82%
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24143Feb 3, 2023TOTOLINKEPSS 1.97%
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.
9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24142Feb 3, 2023TOTOLINKEPSS 1.97%
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.
9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24141Feb 3, 2023TOTOLINKEPSS 1.97%
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.
9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24140Feb 3, 2023TOTOLINKEPSS 1.97%
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.
9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2023-24139Feb 3, 2023TOTOLINKEPSS 1.97%
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.
9.8 Critical severity
N200re-v5 Firmware: Use of Hard-coded Credentials
CVE-2022-48113Feb 2, 2023TOTOLINK
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-48126Jan 20, 2023TOTOLINKEPSS 1.98%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-48125Jan 20, 2023TOTOLINKEPSS 1.98%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-48124Jan 20, 2023TOTOLINKEPSS 1.98%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-48123Jan 20, 2023TOTOLINKEPSS 1.98%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-48122Jan 20, 2023TOTOLINKEPSS 1.98%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-48121Jan 20, 2023TOTOLINKEPSS 1.98%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-47853Jan 17, 2023TOTOLINKEPSS 1.94%
TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-46634Dec 15, 2022TOTOLINKEPSS 2.06%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg function.