Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

TOTOLINK A3300R firmwareOS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.

First published (updated )
CVE-2026-31177

TOTOLINK A3300R firmwareOS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to /cgi-bin/cstecgi.cgi.

First published (updated )
CVE-2026-31178

TOTOLINK A3300R firmwareCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi.

First published (updated )
CVE-2026-31175

TOTOLINK ToToLink A3300R firmwareOS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.

First published (updated )
CVE-2026-31181

TOTOLINK Totolink A3300RCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to /cgi-bin/cstecgi.cgi.

First published (updated )
CVE-2026-31170
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK A3300RTOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519…

Risk 66
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

TOTOLINK A3300R V17.0.0cu.557B20221024 and N200RE V9.3.5u.6448B20240521 and V9.3.5u.6437B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in (remote).

First published (updated )
CVE-2025-55895

TOTOLINK A3300RCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink A3300R V17.0.0cu.596B20250515 was found to contain a command injection vulnerability in the sub4197C0 function via the mac and desc parameters. This vulnerability allows unauthenticated attackers to execute arbitrary commands via a crafted request.

First published (updated )
CVE-2025-52046

TOTOLINK A800ROS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A800R V4.1.2cu.5137B20200730, A810R V4.1.2cu.5182B20201026, A830R V4.1.2cu.5182B20201102, A950RG V4.1.2cu.5161B20200903, A3000RU V5.9c.5185B20201128, and A3100R V4.1.2cu.5247B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function through the hostTime parameter.

First published (updated )
CVE-2025-28034

TOTOLINK A830ROS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A830R V4.1.2cu.5182B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

First published (updated )
CVE-2025-28035

TOTOLINK A950RGOS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A950RG V4.1.2cu.5161B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.

First published (updated )
CVE-2025-28036
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.

First published (updated )
CVE-2024-24329

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function.

First published (updated )
CVE-2024-24332

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function.

First published (updated )
CVE-2024-24327

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function.

First published (updated )
CVE-2024-24333

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules function.

First published (updated )
CVE-2024-24326
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function.

First published (updated )
CVE-2024-24331

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.

First published (updated )
CVE-2024-24328

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg function.

First published (updated )
CVE-2024-24330

TOTOLINK A3300R firmwareCommand Injection, OS Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function.

First published (updated )
CVE-2024-24325

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function.

First published (updated )
CVE-2024-23058
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function.

First published (updated )
CVE-2024-22942

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function.

First published (updated )
CVE-2024-23061

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function.

First published (updated )
CVE-2024-23057

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function.

First published (updated )
CVE-2024-23060

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 61
Severity
9.8
EPSS
0.48%
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function.

First published (updated )
CVE-2024-23059
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK A3300R firmwareCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R 17.0.0cu.557B20221024 contains a command injection via the filename parameter in the UploadFirmwareFile function.

First published (updated )
CVE-2023-46976

TOTOLINK A3300R firmwareCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In TOTOLINK A3300R V17.0.0cu.557B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection.

First published (updated )
CVE-2023-46993

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.

First published (updated )
CVE-2023-37172

TOTOLINK A3300R firmwareOS Command Injection, Command Injection

Risk 86
Severity
9.8
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.

First published (updated )
CVE-2023-37171

TOTOLINK A3300R firmwareOS Command Injection

Risk 86
Severity
9.8
OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.

First published (updated )
CVE-2023-37170
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203