Vulnerabilities

TI-2024-35769 CVE-2024-53333 · GHSA-pj8j-q75x-3c3f

TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion…

MEDIUM 61

TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function.

CVSS 3.1MEDIUM 6.3 Network Low privileges User interaction EPSS 0.21231 Published 2024-11-21 No fix listed CWE-77

TI-2024-06797 CVE-2024-7336 · GHSA-vp2r-2xj4-fq27

TOTOLINK EX200 cstecgi.cgi loginauth buffer overflow

HIGH 73

A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0127 Published 2024-08-01 No fix listed CWE-120

TI-2024-06796 CVE-2024-7335 · GHSA-c627-r4px-c33f

TOTOLINK EX200 getSaveConfig buffer overflow

HIGH 73

A vulnerability classified as critical has been found in TOTOLINK EX200 4.0.3c.7646_B20201211.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01157 Published 2024-08-01 No fix listed CWE-120

TI-2024-20942 CVE-2024-31810 · GHSA-cc7f-xj8f-c4mm

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

HIGH 82

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00615 Published 2024-05-13 No fix listed CWE-259

TI-2024-21279 CVE-2024-32326 · GHSA-h3hp-g22h-899v

TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability…

LOW 31

TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderConfig function.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00575 Published 2024-04-18 No fix listed CWE-79

TI-2024-21278 CVE-2024-32325 · GHSA-2cww-rcpx-vmvj

TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability…

MEDIUM 46

TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderConfig function.

CVSS 3.1LOW 2.4 Network High privileges User interaction EPSS 0.00488 Published 2024-04-18 No fix listed CWE-79

TI-2024-20949 CVE-2024-31817 · GHSA-h8j8-56g9-735m

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information…

HIGH 72

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.5534 Published 2024-04-08 No fix listed CWE-200

TI-2024-20948 CVE-2024-31816 · GHSA-9qp6-g335-w8ph

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information…

HIGH 72

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWizardCfg.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02702 Published 2024-04-08 No fix listed CWE-200

TI-2024-20947 CVE-2024-31815 · GHSA-gpf5-g943-4fxx

In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file…

MEDIUM 46

In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.sh

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00584 Published 2024-04-08 No fix listed CWE-639

TI-2024-20946 CVE-2024-31814 · GHSA-8qwf-p858-gvg4

TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.

HIGH 79

TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.08325 Published 2024-04-08 No fix listed CWE-288

TI-2024-20945 CVE-2024-31813 · GHSA-wc5v-66fr-qmw9

TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default.

HIGH 72

TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00203 Published 2024-04-08 No fix listed CWE-862

TI-2024-20944 CVE-2024-31812 · GHSA-pw86-gvc3-5wvh

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information…

MEDIUM 62

In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00343 Published 2024-04-08 No fix listed CWE-75

TI-2024-20943 CVE-2024-31811 · GHSA-gmw5-2r8g-6fwc

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution…

HIGH 68

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg function.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.00975 Published 2024-04-08 No fix listed CWE-77

TI-2024-20941 CVE-2024-31809 · GHSA-75cq-q7qc-2mc2

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution…

HIGH 73

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00979 Published 2024-04-08 No fix listed CWE-75

TI-2024-20940 CVE-2024-31808 · GHSA-23c8-jrp9-f2v5

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution…

HIGH 79

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00926 Published 2024-04-08 No fix listed CWE-233

TI-2024-20939 CVE-2024-31807 · GHSA-cpff-vh9v-hmch

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution…

HIGH 82

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01368 Published 2024-04-08 No fix listed CWE-94

TI-2024-20938 CVE-2024-31806 · GHSA-v9hm-fcq5-j7h7

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS)…

MEDIUM 62

TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the system without authorization.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00391 Published 2024-04-08 No fix listed CWE-75

TI-2024-20937 CVE-2024-31805 · GHSA-h2xm-59gc-23mm

TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service…

MEDIUM 62

TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg function.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00503 Published 2024-04-08 No fix listed CWE-284

TI-2021-19537 CVE-2021-43711 · GHSA-chwf-9c6x-wv85

The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command…

HIGH 69

The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.37835 Published 2022-01-04 No fix listed CWE-77

Vulnerabilities

Filters