TOTOLINK vulnerabilities

We track 806 vulnerabilities in TOTOLINK products across 60+ products. 806 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.

806vulnerabilities

451critical

355high

0exploited

9.2average CVSS score

Latest TOTOLINK vulnerabilities

9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-46631Dec 15, 2022TOTOLINKEPSS 2.06%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCfg function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-44844Nov 25, 2022TOTOLINKEPSS 2%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-44843Nov 25, 2022TOTOLINKEPSS 2%
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg function.
8.8 High severity
Lr350 Firmware: Out-of-bounds Write
CVE-2022-44259Nov 23, 2022TOTOLINKEPSS 2.27%
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.
8.8 High severity
Nr1800x Firmware: Out-of-bounds Write
CVE-2022-41527Oct 6, 2022TOTOLINKEPSS 1.06%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function.
8.8 High severity
Nr1800x Firmware: Out-of-bounds Write
CVE-2022-41526Oct 6, 2022TOTOLINKEPSS 1.06%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function.
9.8 Critical severity
Nr1800x Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-41525Oct 6, 2022TOTOLINKEPSS 1.95%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi.
8.8 High severity
Nr1800x Firmware: Out-of-bounds Write
CVE-2022-41524Oct 6, 2022TOTOLINKEPSS 1.06%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRules function.
8.8 High severity
Nr1800x Firmware: Out-of-bounds Write
CVE-2022-41523Oct 6, 2022TOTOLINKEPSS 1.06%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function.
8.8 High severity
Nr1800x Firmware: Out-of-bounds Write
CVE-2022-41521Oct 6, 2022TOTOLINKEPSS 1.06%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules function.
8.8 High severity
Nr1800x Firmware: Out-of-bounds Write
CVE-2022-41520Oct 6, 2022TOTOLINKEPSS 1.06%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function.
9.8 Critical severity
Nr1800x Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-41518Oct 6, 2022TOTOLINKEPSS 1.98%
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi.
9.8 Critical severity
A7000ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-38308Sep 14, 2022TOTOLINKEPSS 21.5%
TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. This vulnerability allows attackers to execute arbitrary commands via a crafted payload.
7.8 High severity
A7000r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-37083Aug 25, 2022TOTOLINKEPSS 1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg.
7.8 High severity
A7000r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-37082Aug 25, 2022TOTOLINKEPSS 1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the function NTPSyncWithHost.
7.8 High severity
A7000r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-37081Aug 25, 2022TOTOLINKEPSS 1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg.
7.8 High severity
A7000r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-37079Aug 25, 2022TOTOLINKEPSS 1.2%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
7.8 High severity
A7000r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-37076Aug 25, 2022TOTOLINKEPSS 1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
7.8 High severity
N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36487Aug 25, 2022TOTOLINKEPSS 1.02%
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg.
7.8 High severity
N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36486Aug 25, 2022TOTOLINKEPSS 1.02%
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
7.8 High severity
N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36485Aug 25, 2022TOTOLINKEPSS 1.02%
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
7.8 High severity
N350rt Firmware: Out-of-bounds Write
CVE-2022-36482Aug 25, 2022TOTOLINK
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the lang parameter in the function setLanguageCfg.
7.8 High severity
N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36481Aug 25, 2022TOTOLINKEPSS 1.22%
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the ip parameter in the function setDiagnosisCfg.
7.8 High severity
N350rt Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36479Aug 25, 2022TOTOLINKEPSS 1.02%
TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost.
7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36461Aug 25, 2022TOTOLINKEPSS 1.2%
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36460Aug 25, 2022TOTOLINKEPSS 1.01%
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36459Aug 25, 2022TOTOLINKEPSS 1.01%
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost.
7.8 High severity
A3700r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-36458Aug 25, 2022TOTOLINKEPSS 1.01%
TOTOLINK A3700R V9.1.2u.6134_B20201202 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg.
9.8 Critical severity
Ex300 V2 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-32449Jul 7, 2022TOTOLINKEPSS 19.4%
TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vulnerability is exploitable via a crafted MQTT data packet.
7.2 High severity
A830r Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-28935Jul 6, 2022TOTOLINKEPSS 3.3%
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to cont
7.5 High severity
T6 Firmware: Out-of-bounds Write
CVE-2022-32051Jul 1, 2022TOTOLINKEPSS 1.14%
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.
7.5 High severity
A3600r Firmware: Out-of-bounds Write
CVE-2022-29377May 24, 2022TOTOLINKEPSS 1.07%
Totolink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a stacker overflow in the fread function at infostat.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via the parameter CONTENT_LENGTH.
9.8 Critical severity
A3100r Firmware: Use of Hard-coded Credentials
CVE-2022-29645May 18, 2022TOTOLINKEPSS 1.47%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shadow.sample.
9.8 Critical severity
A3100r Firmware: Use of Hard-coded Credentials
CVE-2022-29644May 18, 2022TOTOLINKEPSS 1.6%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the component /web_cste/cgi-bin/product.ini.
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29643May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter in the function setMacQos. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST re
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29642May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST r
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29641May 18, 2022TOTOLINKEPSS 1.19%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) vi
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29640May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted
7.5 High severity
A3100r Firmware: Out-of-bounds Write
CVE-2022-29638May 18, 2022TOTOLINKEPSS 1.18%
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST r
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28913May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.