TOTOLINK

Records1322All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical616CVSS 9.0–10.0

CVSS high434CVSS 7.0–8.9

Exploited now

TOTOLINK records in CISA KEV

No TOTOLINK vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

X5000r Firmware 70 records HIGH A3300r Firmware 64 records HIGH A3002r Firmware 61 records HIGH X6000r Firmware 57 records HIGH A3002ru Firmware 49 records HIGH A3100r Firmware 47 records HIGH X2000r Firmware 45 records HIGH A3700r Firmware 43 records CRITICAL

Records

38 records in N600r Firmware · all components

TI-2025-32319 CVE-2025-51390 · GHSA-mxgh-9h4r-vp5w

TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection…

HIGH 82

TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01758 Published 2025-08-04 No fix listed CWE-78

TI-2025-28923 CVE-2025-46060 · GHSA-j345-5vxf-wffq

Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote…

HIGH 82

Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00969 Published 2025-06-13 No fix listed CWE-120

TI-2025-10484 CVE-2025-11444 · GHSA-45rh-24p6-9743

TOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig buffer overflow

HIGH 73

A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01064 Published 2025-10-08 No fix listed CWE-119

TI-2025-04012 CVE-2025-4496 · GHSA-96qf-wf2v-wxvc

TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow

HIGH 73

A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01231 Published 2025-05-10 No fix listed CWE-119

TI-2025-37647 CVE-2025-60335 · GHSA-qm6p-qf3f-94pq

A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506…

HIGH 72

A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02132 Published 2025-10-22 No fix listed CWE-476

TI-2025-37646 CVE-2025-60334 · GHSA-jfr6-x3x6-w978

TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the…

HIGH 72

TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00589 Published 2025-10-22 No fix listed CWE-121

TI-2025-37645 CVE-2025-60333 · GHSA-6359-gr6g-2wx3

TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the…

HIGH 72

TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0049 Published 2025-10-22 No fix listed CWE-121

TI-2025-09116 CVE-2025-9935 · GHSA-9f5w-jc5j-mr6j

TOTOLINK N600R cstecgi.cgi sub_4159F8 command injection

HIGH 70

A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.02726 Published 2025-09-03 No fix listed CWE-74

TI-2025-37648 CVE-2025-60336 · GHSA-x36f-6qhh-53j9

A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R…

HIGH 66

A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01773 Published 2025-10-22 No fix listed CWE-476

TI-2022-09623 CVE-2022-26187 · GHSA-84q3-wqp7-r229

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection…

MEDIUM 60

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.19579 Published 2022-03-22 No fix listed CWE-77

TI-2025-35587 CVE-2025-57623 · GHSA-6wx9-5wq9-rr87

A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows…

MEDIUM 57

A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00385 Published 2025-09-25 No fix listed CWE-476

TI-2025-16765 CVE-2025-22903 · GHSA-r3xh-xmm6-qp4w

TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the…

MEDIUM 54

TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.00225 Published 2025-04-15 No fix listed CWE-121

TI-2025-16764 CVE-2025-22900 · GHSA-7jww-p4g2-4fpv

Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the…

MEDIUM 50

Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00575 Published 2025-04-15 No fix listed CWE-121

TI-2023-23115 CVE-2023-43141 · GHSA-c2qv-7h5q-gh2f

TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.

MEDIUM 50

TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00787 Published 2023-09-25 No fix listed CWE-284

TI-2022-09622 CVE-2022-26186 · GHSA-pm89-xmvf-hr23

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection…

MEDIUM 49

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03947 Published 2022-03-22 No fix listed CWE-77

TI-2022-09625 CVE-2022-26189 · GHSA-g7cm-8fhp-3cw4

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection…

MEDIUM 48

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03424 Published 2022-03-22 No fix listed CWE-77

TI-2022-09624 CVE-2022-26188 · GHSA-wmrw-27cm-mvhg

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection…

MEDIUM 48

TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03424 Published 2022-03-22 No fix listed CWE-77

TI-2022-11525 CVE-2022-28913 · GHSA-jqfv-hjr7-7h32

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection…

MEDIUM 47

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.