TOTOLINK vulnerabilities

TI-2025-20728 CVE-2025-28137 · GHSA-fchw-692r-4w73

The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote…

HIGH 82

The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.34089 Published 2025-04-15 No fix listed CWE-78

TI-2025-20693 CVE-2025-28037 · GHSA-x7cp-g8mq-6p3p

TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to…

HIGH 82

TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01225 Published 2025-04-22 No fix listed CWE-78

TI-2025-20692 CVE-2025-28036 · GHSA-cm5r-mjj2-pxp4

TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command…

HIGH 82

TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01365 Published 2025-04-22 No fix listed CWE-78

TI-2025-20691 CVE-2025-28035 · GHSA-fg9r-f95c-6rgw

TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command…

HIGH 82

TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01365 Published 2025-04-22 No fix listed CWE-78

TI-2025-20690 CVE-2025-28034 · GHSA-p2gm-m8q4-6r5q

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

HIGH 82

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01365 Published 2025-04-22 No fix listed CWE-78

TI-2025-20680 CVE-2025-28024 · GHSA-vwgx-54x2-gc6m

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi

HIGH 82

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2025-04-22 No fix listed CWE-120

TI-2025-20686 CVE-2025-28030 · GHSA-rgcr-wg7p-29p2

TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the…

HIGH 79

TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the startTime and endTime parameters in setParentalRules function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00466 Published 2025-04-22 No fix listed CWE-121

TI-2025-04012 CVE-2025-4496 · GHSA-96qf-wf2v-wxvc

TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow

HIGH 73

A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01231 Published 2025-05-10 No fix listed CWE-119

TI-2024-35770 CVE-2024-53334 · GHSA-927w-gc63-2rh7

TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.

HIGH 73

TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00732 Published 2024-11-21 No fix listed CWE-120

TI-2025-20726 CVE-2025-28135 · GHSA-5rg6-fchv-4f55

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi.

HIGH 72

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00545 Published 2025-03-27 No fix listed CWE-121

TI-2025-20689 CVE-2025-28033 · GHSA-mp63-mm73-jhgm

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

HIGH 71

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-22 No fix listed CWE-121

TI-2025-20688 CVE-2025-28032 · GHSA-q8pq-pv68-q9cm

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

HIGH 71

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth bu…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00345 Published 2025-04-22 No fix listed CWE-121

TI-2024-37763 CVE-2024-57036 · GHSA-xgj7-v3ff-h29v

TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion…

HIGH 70

TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion vulnerability in downloadFile.cgi main function.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0057 Published 2025-01-21 No fix listed CWE-77

TI-2024-35771 CVE-2024-53335 · GHSA-9w2q-35qr-xff7

TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.

HIGH 67

TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0025 Published 2024-11-21 No fix listed CWE-120

TI-2025-20679 CVE-2025-28022 · GHSA-h5q7-f44m-25fc

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow…

HIGH 65

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-23 No fix listed CWE-120

TI-2025-20678 CVE-2025-28021 · GHSA-m4gg-j947-295m

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow…

HIGH 65

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-23 No fix listed CWE-120

TI-2025-20687 CVE-2025-28031 · GHSA-m9hc-8hvg-f4hc

TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for…

MEDIUM 62

TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00303 Published 2025-04-22 No fix listed CWE-259

TI-2022-09634 CVE-2022-26210 · GHSA-c3h9-pm7m-68qp

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 51

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05693 Published 2022-03-15 No fix listed CWE-78

TI-2022-09638 CVE-2022-26214 · GHSA-mjw3-486f-p3cf

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 47

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02779 Published 2022-03-15 No fix listed CWE-78

TI-2022-09636 CVE-2022-26212 · GHSA-7cpm-mx36-wp4r

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 47

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02779 Published 2022-03-15 No fix listed CWE-78

TI-2022-09635 CVE-2022-26211 · GHSA-27q3-cvqp-pf2m

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 47

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02779 Published 2022-03-15 No fix listed CWE-78

TI-2022-09632 CVE-2022-26208 · GHSA-jx24-x4rm-7jjh

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 47

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02779 Published 2022-03-15 No fix listed CWE-78

TI-2022-08828 CVE-2022-25079 · GHSA-4g9f-cj32-8jmq

TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection…

MEDIUM 47

TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection vulnerability in the "Main" function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02771 Published 2022-02-22 No fix listed CWE-78

TI-2022-09633 CVE-2022-26209 · GHSA-2563-r73r-7cq9

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 46

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02218 Published 2022-03-15 No fix listed CWE-78

TI-2022-09631 CVE-2022-26207 · GHSA-jh3q-ph4x-rfpj

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 46

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02218 Published 2022-03-15 No fix listed CWE-78

Critical	616
High	434
Medium	263
Low	9
No CVSS	0

TOTOLINK

Exploited now

Components

Records

The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote…

TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to…

TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command…

TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command…

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi

TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a stack overflow via the…

TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow

TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi.

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

TOTOLINK A810R V4.1.2cu.5032_B20200407 was found to contain a command insertion…

TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow…

TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow…

TOTOLINK A810R V4.1.2cu.5182_B20201026 was discovered to contain a hardcoded password for…

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

TOTOLink A810R V4.1.2cu.5182_B20201026 was discovered to contain a command injection…

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…