TOTOLINK

Records1322All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical616CVSS 9.0–10.0

CVSS high434CVSS 7.0–8.9

Exploited now

TOTOLINK records in CISA KEV

No TOTOLINK vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

X5000r Firmware 70 records HIGH A3300r Firmware 64 records HIGH A3002r Firmware 61 records HIGH X6000r Firmware 57 records HIGH A3002ru Firmware 49 records HIGH A3100r Firmware 47 records HIGH X2000r Firmware 45 records HIGH A3700r Firmware 43 records CRITICAL

Records

39 records in T6 Firmware · all components

TI-2023-06605 CVE-2023-7221 · GHSA-c653-w7m8-34r2

Totolink T6 HTTP POST Request main buffer overflow

HIGH 82

A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01518 Published 2024-01-09 No fix listed CWE-120

TI-2025-07237 CVE-2025-7913 · GHSA-p5w7-xqf9-725m

TOTOLINK T6 MQTT Service updateWifiInfo buffer overflow

HIGH 73

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00994 Published 2025-07-20 No fix listed CWE-119

TI-2025-07236 CVE-2025-7912 · GHSA-pfrw-775r-c344

TOTOLINK T6 MQTT Service recvSlaveUpgstatus buffer overflow

HIGH 73

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01281 Published 2025-07-20 No fix listed CWE-119

TI-2025-07083 CVE-2025-7758 · GHSA-hp4c-rcfm-82f8

TOTOLINK T6 HTTP POST Request cstecgi.cgi setDiagnosisCfg buffer overflow

HIGH 73

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00994 Published 2025-07-17 No fix listed CWE-119

TI-2025-06798 CVE-2025-7460 · GHSA-xgh4-wmvj-9mvr

TOTOLINK T6 HTTP POST Request cstecgi.cgi setWiFiAclRules buffer overflow

HIGH 73

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0096 Published 2025-07-11 No fix listed CWE-119

TI-2025-06289 CVE-2025-6916 · GHSA-hqqv-6f9q-x66q

TOTOLINK T6 formLoginAuth.htm Form_Login missing authentication

HIGH 73

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015.

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.00888 Published 2025-06-30 No fix listed CWE-287

TI-2025-07475 CVE-2025-8170 · GHSA-h7jx-x34c-vc7c

TOTOLINK T6 MQTT Packet meshSlaveDlfw tcpcheck_net buffer overflow

HIGH 71

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01305 Published 2025-07-25 No fix listed CWE-119

TI-2025-07161 CVE-2025-7837 · GHSA-qxfq-qf96-fww5

TOTOLINK T6 MQTT Service recvSlaveStaInfo buffer overflow

HIGH 71

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01283 Published 2025-07-19 No fix listed CWE-119

TI-2025-07186 CVE-2025-7862 · GHSA-vm25-8x3c-9vc3

TOTOLINK T6 Telnet Service cstecgi.cgi setTelnetCfg missing authentication

HIGH 70

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01212 Published 2025-07-20 No fix listed CWE-287

TI-2022-08833 CVE-2022-25084 · GHSA-77jc-q8hg-fhfv

TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection…

MEDIUM 62

TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21839 Published 2022-02-22 No fix listed CWE-78

TI-2022-18306 CVE-2022-38828 · GHSA-xfff-m68h-gjf7

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi

MEDIUM 61

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20106 Published 2022-09-16 No fix listed CWE-78

TI-2025-07274 CVE-2025-7952 · GHSA-mh37-2gxv-wprp

TOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injection

MEDIUM 57

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.24524 Published 2025-07-22 No fix listed CWE-74

TI-2025-06952 CVE-2025-7615 · GHSA-5c57-5xxh-xxwp

TOTOLINK T6 HTTP POST Request cstecgi.cgi clearPairCfg command injection

MEDIUM 57

A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0238 Published 2025-07-14 No fix listed CWE-74

TI-2025-06951 CVE-2025-7614 · GHSA-x6r6-jj5x-xc42

TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injection

MEDIUM 57

A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0238 Published 2025-07-14 No fix listed CWE-74

TI-2025-06950 CVE-2025-7613 · GHSA-93qm-7rvr-h5vr

TOTOLINK T6 HTTP POST Request cstecgi.cgi CloudSrvVersionCheck command injection

MEDIUM 57

A vulnerability was found in TOTOLINK T6 4.1.5cu.748.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0238 Published 2025-07-14 No fix listed CWE-74

TI-2025-06862 CVE-2025-7525 · GHSA-9h9m-2xjq-cm6v

TOTOLINK T6 HTTP POST Request cstecgi.cgi setTracerouteCfg command injection

MEDIUM 57

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02828 Published 2025-07-13 No fix listed CWE-74

TI-2025-06861 CVE-2025-7524 · GHSA-qf5m-3vrf-gwx9

TOTOLINK T6 HTTP POST Request cstecgi.cgi setDiagnosisCfg command injection

MEDIUM 57

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02828 Published 2025-07-13 No fix listed CWE-74

TI-2022-18305 CVE-2022-38827 · GHSA-vqqm-rwvp-vgrr

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi

MEDIUM 56

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.12507 Published 2022-09-16 No fix listed CWE-120

TI-2022-08853 CVE-2022-25134 · GHSA-p978-563h-q2jg

A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology…

MEDIUM 48

A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02992 Published 2022-02-18 No fix listed CWE-77

TI-2022-08854 CVE-2022-25135 · GHSA-394g-x62m-8p96

A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK…

MEDIUM 47

A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02934 Published 2022-02-18 No fix listed CWE-77

TI-2022-08852 CVE-2022-25133 · GHSA-f9qj-ffgv-pff9

A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology…

MEDIUM 47

A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02909 Published 2022-02-18 No fix listed CWE-77

TI-2022-08851 CVE-2022-25132 · GHSA-42rh-j929-h8h4

A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology…

MEDIUM 47

A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02909 Published 2022-02-18 No fix listed CWE-77

TI-2022-08856 CVE-2022-25137 · GHSA-pmgp-jxgv-gw87

A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK…

MEDIUM 46

A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02198 Published 2022-02-18 No fix listed CWE-77

TI-2022-08855 CVE-2022-25136 · GHSA-6wc8-j6cc-j854

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology…

MEDIUM 46

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitra…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02198 Published 2022-02-18 No fix listed CWE-77

TI-2022-08850 CVE-2022-25131 · GHSA-3f7r-9x8g-xf8x

A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK…

MEDIUM 46

A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execu…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02198 Published 2022-02-18 No fix listed CWE-77

Open these records in search →

Critical	616
High	434
Medium	263
Low	9
No CVSS	0