Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how totolink compares to other vendors in security performance

View Risk Score →

Software

totolink t6
74
totolink a3300r firmware
43
totolink x6000r ax3000
41
totolink a7100ru
37
totolink a3600r firmware
33
totolink x2000r
31
totolink x2000r firmware
31
totolink n600r
30
totolink a3300r
29
totolink a3002r
27
totolink a3100r firmware
27
totolink a3002r firmware
26
totolink a3100r
26
totolink x5000r firmware
26
totolink t8 firmware
23
totolink a3002ru
22
totolink ex1800t
22
totolink a950rg
21
totolink lr350 firmware
17
totolink a3700r firmware
15
totolink a810r
15
totolink a7000r firmware
14
totolink a800r firmware
14
totolink a830r
14
totolink ca300-poe
14
totolink lr1200gb firmware
14
totolink t10 v2 firmware
14
totolink t6 firmware
14
totolink x15
14
totolink a3000ru firmware
13
totolink a702r firmware
13
totolink a702r-v3
13
totolink a800r
13
totolink ex1200t
13
totolink lr350
13
totolink ex1200l firmware
11
totolink n200re firmware
10
totolink a720r firmware
9
totolink cp900 firmware
9
totolink n150rt-v2 firmware
9
totolink x18
9
totolink x18 firmware
9
totolink x5000r
8
totolink x6000r
8
totolink nr1800x firmware
7
totolink t10 firmware
7
totolink x15 firmware
7
totolink a860r firmware
6
totolink ex200
6
totolink n200re-v3 firmware
6

TOTOLINK X2000ROS Command Injection, Command Injection

Risk 72
Severity
9.1
OS Command Injection, Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-35499

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-41223

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-28763

TOTOLINK X2000ROS Command Injection, Command Injection

Risk 72
Severity
9.1
OS Command Injection, Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-40627

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-41222

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-40615

TOTOLINK X2000ROS Command Injection, Command Injection

Risk 72
Severity
9.1
OS Command Injection, Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-33568

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoedns2 parameter.

First published (updated )
CVE-2026-42020

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoedns1 parameter.

First published (updated )
CVE-2026-42019

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the staticdns2 parameter.

First published (updated )
CVE-2026-42022

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcpdns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcpdns1 parameter.

First published (updated )
CVE-2026-42025

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the staticgw parameter.

First published (updated )
CVE-2026-42024

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the staticipv6 parameter.

First published (updated )
CVE-2026-42023

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcpdns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcpdns2 parameter.

First published (updated )
CVE-2026-42026

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the staticdns1 parameter.

First published (updated )
CVE-2026-42021

TOTOLINK X2000ROS Command Injection, Command Injection

Risk 54
Severity
9.1
EPSS
1.30%
OS Command Injection, Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-9814

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.

First published (updated )
CVE-2026-9660

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.

First published (updated )
CVE-2026-9659

TOTOLINK X2000RPath Traversal

Risk 54
Severity
9.1
EPSS
0.98%
Path Traversal
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-9827

TOTOLINK X2000RBuffer Overflow

Risk 54
Severity
9.1
EPSS
0.79%
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-9869

TOTOLINK X2000RBuffer Overflow

Risk 54
Severity
9.1
EPSS
0.79%
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-9817

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10133

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10132

TOTOLINK X2000ROS Command Injection, Command Injection

Risk 72
Severity
9.1
OS Command Injection, Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10131

TOTOLINK X2000ROS Command Injection, Command Injection

Risk 72
Severity
9.1
OS Command Injection, Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10135

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10136

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10137

TOTOLINK X2000ROS Command Injection, Command Injection

Risk 72
Severity
9.1
OS Command Injection, Command Injection
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10138

TOTOLINK X2000RBuffer Overflow

Risk 72
Severity
9.1
Buffer Overflow
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10139

TOTOLINK X2000RA Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version…

Risk 72
Severity
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted firmware binary can lead to arbitrary firmware update. An attacker can make an authenticated HTTP request to trigger this vulnerability.

First published (updated )
CVE-2026-10141

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203