Where
-Infinity
0

Trending

Last week
Last month
Last year

TOTOLINK A800ROS Command Injection

Risk 61
Severity
9.8
EPSS
0.21%
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The TOTOLINK A800R V4.1.2cu.5137B20200730 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

First published (updated )
CVE-2025-28138

TOTOLINK A800ROS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function through the hostTime parameter.

First published (updated )
CVE-2025-28034

TOTOLINK A830ROS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A830R V4.1.2cu.5182B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

First published (updated )
CVE-2025-28035

TOTOLINK A950RGOS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

First published (updated )
CVE-2025-28036

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setWebWlanIdx, via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2022-26208

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setDiagnosisCfg, via the ipDoamin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2022-26207

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setUploadSetting, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2022-26209

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2022-26210

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setLanguageCfg, via the langType parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2022-26206

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function CloudACMunualUpdate, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2022-26211

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setDeviceName, via the deviceMac and deviceName parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2022-26212

TOTOLINK A830r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the hosttime parameter.

First published (updated )
CVE-2022-26214

TOTOLINK A800r FirmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink A800R V4.1.2cu.5137B20200730 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERYSTRING parameter.

First published (updated )
CVE-2022-25076

TOTOLINK A800r FirmwareTOTOLINK A800R V4.1.2cu.5137_B20200730 was discovered to contain a hardcoded password for root at /e…

Risk 69
Severity
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A800R V4.1.2cu.5137B20200730 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

First published (updated )
CVE-2022-36611

TOTOLINK A800RTOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

First published (updated )
CVE-2026-19811

TOTOLINK A800RTOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A weakness has been identified in TOTOLINK A800R 4.1.2cu.5137B20200730. This affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component product.so. This manipulation of the argument File causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

First published (updated )
CVE-2026-19812

TOTOLINK A800RTOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Such manipulation of the argument Comment leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

First published (updated )
CVE-2026-19813

TOTOLINK A800RTOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A flaw has been found in TOTOLINK A800R 4.1.2cu.5137B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

First published (updated )
CVE-2026-19815

TOTOLINK A800RTOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A vulnerability was detected in TOTOLINK A800R 4.1.2cu.5137B20200730. Affected is the function setMacQos of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Performing a manipulation of the argument macAddress results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used.

First published (updated )
CVE-2026-19814

TOTOLINK A800RTOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

First published (updated )
CVE-2026-19844

TOTOLINK A800RTOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

First published (updated )
CVE-2026-19845

TOTOLINK A800RTOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

First published (updated )
CVE-2026-19846

TOTOLINK A800RTOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow

Risk 78
Severity
7.4
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

First published (updated )
CVE-2026-19847

TOTOLINK A800RBuffer Overflow

Risk 51
Severity
7.3
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpForm parameter.

First published (updated )
CVE-2025-28032

TOTOLINK A800RBuffer Overflow

Risk 51
Severity
7.3
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpTo parameter.

First published (updated )
CVE-2025-28033

TOTOLINK A800RBuffer Overflow

Risk 51
Severity
7.3
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

TOTOLINK A800R V4.1.2cu.5137B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.

First published (updated )
CVE-2025-28018

TOTOLINK A800RBuffer Overflow

Risk 51
Severity
7.3
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

TOTOLINK A800R V4.1.2cu.5137B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component

First published (updated )
CVE-2025-28019

TOTOLINK A800RBuffer Overflow

Risk 51
Severity
7.3
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

TOTOLINK A800R V4.1.2cu.5137B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.

First published (updated )
CVE-2025-28020

TOTOLINK A830r FirmwareCommand Injection

Risk 66
Severity
7.2
Command Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Totolink A830R V5.9c.4729B20191112, Totolink A3100R V4.1.2cu.5050B20200504, Totolink A950RG V4.1.2cu.5161B20200903, Totolink A800R V4.1.2cu.5137B20200730, Totolink A3000RU V5.9c.5185B20201128, Totolink A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability.

First published (updated )
CVE-2022-28935

TOTOLINK A800RBuffer Overflow

Risk 40
Severity
6.5
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

TOTOLINK A800R V4.1.2cu.5137B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi.

First published (updated )
CVE-2025-28136

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203