Vulnerabilities

TI-2025-35575 CVE-2025-57579 · GHSA-fv6j-75mv-78gq

An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote…

HIGH 70

An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00608 Published 2025-09-12 No fix listed CWE-798

TI-2025-08770 CVE-2025-9577 · GHSA-g76c-g25x-rqgp

TOTOLINK X2000R Administrative shadow.sample default credentials

MEDIUM 44

A security flaw has been discovered in TOTOLINK X2000R up to 2.0.0.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00223 Published 2025-08-28 No fix listed CWE-1392

TI-2025-07486 CVE-2025-8181 · GHSA-2j2w-6vxv-4p23

TOTOLINK N600R/X2000R FTP Service vsftpd.conf least privilege violation

LOW 39

A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01116 Published 2025-07-26 No fix listed CWE-266

TI-2025-04983 CVE-2025-5543 · GHSA-9xf4-53cr-j936

TOTOLINK X2000R Parent Controls Page cross site scripting

MEDIUM 55

A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00346 Published 2025-06-03 No fix listed CWE-79

TI-2025-04982 CVE-2025-5542 · GHSA-r4gf-vjqx-5r7p

TOTOLINK X2000R Virtual Server Page formPortFw cross site scripting

MEDIUM 55

A vulnerability was found in TOTOLINK X2000R 1.0.0-B20230726.1108.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00344 Published 2025-06-03 No fix listed CWE-79

TI-2025-04956 CVE-2025-5516 · GHSA-r8gp-c62w-m7jr

TOTOLINK X2000R URL Filtering Page formFilter cross site scripting

MEDIUM 55

A vulnerability, which was classified as problematic, was found in TOTOLINK X2000R 1.0.0-B20230726.1108.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00371 Published 2025-06-03 No fix listed CWE-79

TI-2025-04955 CVE-2025-5515 · GHSA-7pcg-pjpf-rf23

TOTOLINK X2000R formMapDel command injection

MEDIUM 57

A vulnerability, which was classified as critical, has been found in TOTOLINK X2000R 1.0.0-B20230726.1108.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.03441 Published 2025-06-03 No fix listed CWE-74

TI-2025-04944 CVE-2025-5504 · GHSA-j9x6-j7hr-4vpf

TOTOLINK X2000R formWsc command injection

MEDIUM 57

A vulnerability has been found in TOTOLINK X2000R 1.0.0-B20230726.1108 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.13953 Published 2025-06-03 No fix listed CWE-74

TI-2024-22061 CVE-2024-33433 · GHSA-mw95-jjmc-q5f9

Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows…

MEDIUM 55

Cross Site Scripting vulnerability in TOTOLINK X2000R before v1.0.0-B20231213.1013 allows a remote attacker to execute arbitrary code via the Guest Access Control parameter in the Wireless Page.

CVSS 3.1MEDIUM 4.8 Adjacent network Low privileges User interaction EPSS 0.00633 Published 2024-05-13 No fix listed CWE-233

TI-2024-18862 CVE-2024-28402 · GHSA-x5qq-mm82-fv4j

TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS)…

MEDIUM 60

TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page.

CVSS 3.1MEDIUM 5.9 Adjacent network Low privileges User interaction EPSS 0.00428 Published 2024-03-21 No fix listed CWE-79

TI-2024-19453 CVE-2024-29419 · GHSA-g6gj-xwhj-g7rm

There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the…

LOW 25

There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B20231213.1013.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00389 Published 2024-03-20 No fix listed CWE-79

TI-2024-18864 CVE-2024-28404 · GHSA-h54h-77gg-v4vm

TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS)…

HIGH 68

TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.

CVSS 3.1HIGH 8.0 Adjacent network No auth User interaction EPSS 0.0048 Published 2024-03-15 No fix listed CWE-79

TI-2024-18863 CVE-2024-28403 · GHSA-2w55-9hqf-xw99

TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.

LOW 25

TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00389 Published 2024-03-15 No fix listed CWE-79

TI-2024-18861 CVE-2024-28401 · GHSA-hwmm-q6w7-j593

TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS)…

LOW 25

TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wireless Page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00389 Published 2024-03-15 No fix listed CWE-79

TI-2024-15053 CVE-2024-22529 · GHSA-rx6w-gc3r-2fh2

TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the…

MEDIUM 46

TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040 (handle function of formUploadFile) of /bin/boa.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0173 Published 2024-01-25 No fix listed CWE-77

TI-2024-00537 CVE-2024-0579 · GHSA-8m2p-3j92-v9rw

Totolink X2000R formMapDelDevice command injection

LOW 28

A vulnerability classified as critical was found in Totolink X2000R 1.0.0-B20221212.1452.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02224 Published 2024-01-16 No fix listed CWE-74

TI-2023-06606 CVE-2023-7222 · GHSA-jjvf-rww2-493v

Totolink X2000R HTTP POST Request boa formTmultiAP buffer overflow

MEDIUM 46

A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0132 Published 2024-01-09 No fix listed CWE-120

TI-2023-06593 CVE-2023-7208 · GHSA-cvvm-x945-2wwp

Totolink X2000R_V2 boa formTmultiAP buffer overflow

MEDIUM 46

A vulnerability classified as critical was found in Totolink X2000R_V2 2.0.0-B20230727.10434.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01747 Published 2024-01-07 No fix listed CWE-120

TI-2023-27948 CVE-2023-51136 · GHSA-q7r9-mm8c-fmx3

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow…

MEDIUM 43

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00644 Published 2023-12-30 No fix listed CWE-787

TI-2023-27947 CVE-2023-51135 · GHSA-5wpp-x7h9-m8hg

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow…

MEDIUM 43

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00644 Published 2023-12-30 No fix listed CWE-787

TI-2023-27946 CVE-2023-51133 · GHSA-9mf6-c749-mf3h

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.

MEDIUM 50

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00644 Published 2023-12-30 No fix listed CWE-787

TI-2023-25085 CVE-2023-46564 · GHSA-j2q7-6q2x-2q9p

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.

MEDIUM 45

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00978 Published 2023-10-25 No fix listed CWE-121

TI-2023-25084 CVE-2023-46563 · GHSA-p678-r7cm-66fh

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.

MEDIUM 45

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00978 Published 2023-10-25 No fix listed CWE-121

TI-2023-25083 CVE-2023-46562 · GHSA-3g9h-f994-3h4c

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.

MEDIUM 45

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00978 Published 2023-10-25 No fix listed CWE-121

TI-2023-25082 CVE-2023-46560 · GHSA-h43q-h523-j594

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.

MEDIUM 45

TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00978 Published 2023-10-25 No fix listed CWE-121

Vulnerabilities

Filters