Vulnerabilities

TI-2025-41159 CVE-2025-67189 · GHSA-27qh-whg4-7h58

A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK…

MEDIUM 62

A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.0045 Published 2026-02-03 No fix listed CWE-120

TI-2025-41158 CVE-2025-67188 · GHSA-wv35-4hfx-h763

A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112.

HIGH 82

A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00683 Published 2026-02-03 No fix listed CWE-120

TI-2025-41157 CVE-2025-67187 · GHSA-83jp-7r6c-8wcg

A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG…

HIGH 76

A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00521 Published 2026-02-03 No fix listed CWE-121

TI-2025-41156 CVE-2025-67186 · GHSA-xf8g-xrmp-prrv

TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the…

HIGH 82

TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00825 Published 2026-02-03 No fix listed CWE-120

TI-2025-37775 CVE-2025-60702 · GHSA-chxj-6g8r-wh5q

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware…

HIGH 70

A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02559 Published 2025-11-13 No fix listed CWE-77

TI-2025-37772 CVE-2025-60699 · GHSA-g776-ww5q-qfqq

A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware…

MEDIUM 64

A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00899 Published 2025-11-13 No fix listed CWE-121

TI-2025-28642 CVE-2025-44655 · GHSA-c4ww-38fc-m44w

In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is…

MEDIUM 49

In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00381 Published 2025-07-21 No fix listed CWE-266

TI-2025-04012 CVE-2025-4496 · GHSA-96qf-wf2v-wxvc

TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow

HIGH 73

A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01231 Published 2025-05-10 No fix listed CWE-119

TI-2025-28852 CVE-2025-45798 · GHSA-p797-f93r-qxjf

A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112.

HIGH 82

A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01363 Published 2025-05-08 No fix listed CWE-77

TI-2025-28851 CVE-2025-45797 · GHSA-g4cf-3pjw-w4xj

TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability.

HIGH 75

TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18331 Published 2025-05-08 No fix listed CWE-121

TI-2025-28853 CVE-2025-45800 · GHSA-56gh-5cpc-w3cc

TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the…

MEDIUM 51

TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, specifically in the processing of the deviceMac parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00966 Published 2025-05-02 No fix listed CWE-77

TI-2025-20684 CVE-2025-28028 · GHSA-x4wh-mww5-5258

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU…

HIGH 65

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through t…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-23 No fix listed CWE-120

TI-2025-20681 CVE-2025-28025 · GHSA-99gc-w2rj-vq34

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU…

HIGH 65

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through t…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-23 No fix listed CWE-120

TI-2025-20693 CVE-2025-28037 · GHSA-x7cp-g8mq-6p3p

TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to…

HIGH 82

TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01225 Published 2025-04-22 No fix listed CWE-78

TI-2025-20692 CVE-2025-28036 · GHSA-cm5r-mjj2-pxp4

TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command…

HIGH 82

TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01365 Published 2025-04-22 No fix listed CWE-78

TI-2025-20691 CVE-2025-28035 · GHSA-fg9r-f95c-6rgw

TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command…

HIGH 82

TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01365 Published 2025-04-22 No fix listed CWE-78

TI-2025-20690 CVE-2025-28034 · GHSA-p2gm-m8q4-6r5q

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

HIGH 82

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01365 Published 2025-04-22 No fix listed CWE-78

TI-2025-20689 CVE-2025-28033 · GHSA-mp63-mm73-jhgm

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

HIGH 71

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-22 No fix listed CWE-121

TI-2025-20688 CVE-2025-28032 · GHSA-q8pq-pv68-q9cm

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R…

HIGH 71

TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth bu…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00345 Published 2025-04-22 No fix listed CWE-121

TI-2025-20685 CVE-2025-28029 · GHSA-286f-m35x-h7r5

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU…

HIGH 71

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-22 No fix listed CWE-121

TI-2025-20683 CVE-2025-28027 · GHSA-2m4j-5h27-9q77

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU…

HIGH 71

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-22 No fix listed CWE-121

TI-2025-20682 CVE-2025-28026 · GHSA-gg8q-wm6m-x7w3

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU…

HIGH 71

TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.004 Published 2025-04-22 No fix listed CWE-121

TI-2022-16911 CVE-2022-36612 · GHSA-pm3q-5qr2-8728

TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

LOW 34

TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00296 Published 2022-08-28 No fix listed CWE-798

TI-2022-11538 CVE-2022-28935 · GHSA-6hhx-vm7m-j47c

Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink…

LOW 38

Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2c…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.03299 Published 2022-07-06 No fix listed CWE-77

TI-2022-09638 CVE-2022-26214 · GHSA-mjw3-486f-p3cf

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG…

MEDIUM 47

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to conta…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02779 Published 2022-03-15 No fix listed CWE-78

Vulnerabilities

Filters