TOTOLINK

Records1322All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical616CVSS 9.0–10.0

CVSS high434CVSS 7.0–8.9

Exploited now

TOTOLINK records in CISA KEV

No TOTOLINK vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

X5000r Firmware 70 records HIGH A3300r Firmware 64 records HIGH A3002r Firmware 61 records HIGH X6000r Firmware 57 records HIGH A3002ru Firmware 49 records HIGH A3100r Firmware 47 records HIGH X2000r Firmware 45 records HIGH A3700r Firmware 43 records CRITICAL

Records

14 records in X18 Firmware · all components

TI-2025-37900 CVE-2025-61044 · GHSA-fp7p-3ghq-63mp

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0102 Published 2025-10-01 No fix listed CWE-77

TI-2025-21012 CVE-2025-29209 · GHSA-p688-g48x-vg8h

TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in…

HIGH 82

TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01211 Published 2025-04-18 No fix listed CWE-77

TI-2025-20980 CVE-2025-29064 · GHSA-rmr8-rg92-5f98

An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute…

HIGH 82

An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00793 Published 2025-04-03 No fix listed CWE-94

TI-2023-14025 CVE-2023-29803 · GHSA-m87r-j77f-7wpr

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02138 Published 2023-04-14 No fix listed CWE-77

TI-2023-14024 CVE-2023-29802 · GHSA-f938-mprp-hxgv

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02014 Published 2023-04-14 No fix listed CWE-77

TI-2023-14023 CVE-2023-29801 · GHSA-w6cf-v879-2jqv

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02014 Published 2023-04-14 No fix listed CWE-77

TI-2023-14022 CVE-2023-29800 · GHSA-m5vc-m25p-pq4q

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02014 Published 2023-04-14 No fix listed CWE-77

TI-2023-14021 CVE-2023-29799 · GHSA-wxhc-w2rg-6qcw

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02014 Published 2023-04-14 No fix listed CWE-77

TI-2023-14020 CVE-2023-29798 · GHSA-7gcr-m3c2-5x75

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02014 Published 2023-04-14 No fix listed CWE-77

TI-2025-37901 CVE-2025-61045 · GHSA-2pvf-rfmw-cwjg

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection…

HIGH 76

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01539 Published 2025-10-01 No fix listed CWE-78

TI-2025-01151 CVE-2025-1340 · GHSA-2f5r-p45g-vr7g

TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow

HIGH 73

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.16672 Published 2025-02-16 No fix listed CWE-119

TI-2025-01150 CVE-2025-1339 · GHSA-27g6-qpfh-w967

TOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injection

MEDIUM 59

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02569 Published 2025-02-16 No fix listed CWE-77

TI-2025-01576 CVE-2025-1829 · GHSA-mwjq-q4w6-76fx

TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection

MEDIUM 57

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.12376 Published 2025-03-02 No fix listed CWE-77

TI-2024-10165 CVE-2024-10966 · GHSA-mw3p-xpcv-h9gq

TOTOLINK X18 cstecgi.cgi os command injection

MEDIUM 57

A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.03235 Published 2024-11-07 No fix listed CWE-77

Open these records in search →