TOTOLINK vulnerabilities

We track 806 vulnerabilities in TOTOLINK products across 60+ products. 806 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2026.

806vulnerabilities

451critical

355high

0exploited

9.2average CVSS score

Latest TOTOLINK vulnerabilities

9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28911May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28910May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28909May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28908May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28907May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28906May 10, 2022TOTOLINKEPSS 2.87%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.
9.8 Critical severity
N600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28905May 10, 2022TOTOLINKEPSS 2.54%
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28584May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28583May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28582May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28581May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28580May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28579May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28578May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28577May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands through a carefully constructed payload.
9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-28575May 5, 2022TOTOLINKEPSS 3%
It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows attackers to execute arbitrary commands through a carefully constructed payload
9.8 Critical severity
x5000r_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27005Mar 15, 2022TOTOLINKEPSS 5.46%
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary comma
9.8 Critical severity
x5000r_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27004Mar 15, 2022TOTOLINKEPSS 2.9%
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary c
9.8 Critical severity
x5000r_firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-27003Mar 15, 2022TOTOLINKEPSS 2.9%
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary comm
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26214Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
X5000r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26213Mar 15, 2022TOTOLINKEPSS 25.6%
Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26212Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26211Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26210Mar 15, 2022TOTOLINKEPSS 5.69%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26209Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26208Mar 15, 2022TOTOLINKEPSS 2.78%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26207Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-26206Mar 15, 2022TOTOLINKEPSS 2.22%
Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in
9.8 Critical severity
T6 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25084Feb 24, 2022TOTOLINKEPSS 21.8%
TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A860r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25083Feb 24, 2022TOTOLINKEPSS 2.72%
TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A950rg Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25082Feb 24, 2022TOTOLINKEPSS 13.7%
TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
T10 V2 Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25081Feb 24, 2022TOTOLINKEPSS 2.72%
TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A830r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25080Feb 24, 2022TOTOLINKEPSS 2.77%
TOTOLink A830R V5.9c.4729_B20191112 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A810r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25079Feb 24, 2022TOTOLINKEPSS 2.77%
TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A3600r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25078Feb 24, 2022TOTOLINKEPSS 2.77%
TOTOLink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A3100r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25077Feb 24, 2022TOTOLINKEPSS 30.4%
TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A800r Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25076Feb 24, 2022TOTOLINKEPSS 2.77%
TOTOLink A800R V4.1.2cu.5137_B20200730 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
A3000ru Firmware: Improper Neutralization of Special Elements used in an OS Command
CVE-2022-25075Feb 24, 2022TOTOLINKEPSS 56.2%
TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
9.8 Critical severity
T6 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-25137Feb 19, 2022TOTOLINKEPSS 2.2%
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet
9.8 Critical severity
T6 Firmware: Improper Neutralization of Special Elements used in a Command
CVE-2022-25136Feb 19, 2022TOTOLINKEPSS 2.2%
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.