Vulnerabilities

TI-2025-37901 CVE-2025-61045 · GHSA-2pvf-rfmw-cwjg

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection…

HIGH 76

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01539 Published 2025-10-01 No fix listed CWE-78

TI-2025-37900 CVE-2025-61044 · GHSA-fp7p-3ghq-63mp

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0102 Published 2025-10-01 No fix listed CWE-77

TI-2025-21012 CVE-2025-29209 · GHSA-p688-g48x-vg8h

TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in…

HIGH 82

TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01211 Published 2025-04-18 No fix listed CWE-77

TI-2025-20980 CVE-2025-29064 · GHSA-rmr8-rg92-5f98

An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute…

HIGH 82

An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00793 Published 2025-04-03 No fix listed CWE-94

TI-2025-01576 CVE-2025-1829 · GHSA-mwjq-q4w6-76fx

TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injection

MEDIUM 57

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.12376 Published 2025-03-02 No fix listed CWE-77

TI-2025-01151 CVE-2025-1340 · GHSA-2f5r-p45g-vr7g

TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow

HIGH 73

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.16672 Published 2025-02-16 No fix listed CWE-119

TI-2025-01150 CVE-2025-1339 · GHSA-27g6-qpfh-w967

TOTOLINK X18 cstecgi.cgi setL2tpdConfig os command injection

MEDIUM 59

A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02569 Published 2025-02-16 No fix listed CWE-77

TI-2024-10165 CVE-2024-10966 · GHSA-mw3p-xpcv-h9gq

TOTOLINK X18 cstecgi.cgi os command injection

MEDIUM 57

A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.03235 Published 2024-11-07 No fix listed CWE-77

TI-2023-14025 CVE-2023-29803 · GHSA-m87r-j77f-7wpr

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02138 Published 2023-04-14 No fix listed CWE-77

TI-2023-14024 CVE-2023-29802 · GHSA-f938-mprp-hxgv

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection…

HIGH 82

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.