Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

TOTOLINK N600RTOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig buffer overflow

Risk 78
Severity
9
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

First published (updated )
CVE-2025-11444

TOTOLINK N600RTOTOLINK N600R cstecgi.cgi sub_4159F8 command injection

Risk 61
Severity
9.8
EPSS
2.73%
Command Injection
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function sub4159F8 of the file /webcste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

First published (updated )
CVE-2025-9935

TOTOLINK N600RCommand Injection, OS Command Injection

Risk 86
Severity
9.8
Command Injection, OS Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.

First published (updated )
CVE-2025-51390

TOTOLINK N600R firmwareBuffer Overflow

Risk 86
Severity
9.8
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866B2022506 allows a remote attacker to execute arbitrary code via the UPLOADFILENAME component

First published (updated )
CVE-2025-46060

TOTOLINK T10TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow

Risk 61
Severity
9.8
EPSS
0.09%
Buffer Overflow
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

First published (updated )
CVE-2025-4496
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK N600RTotolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMa…

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Totolink N600R v4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function.

First published (updated )
CVE-2025-22900

TOTOLINK A3700r FirmwareTOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Contr…

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK A3700R V9.1.2u.6134B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.

First published (updated )
CVE-2023-43141

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the url parame…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN00415bf0.

First published (updated )
CVE-2022-29399

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the File param…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN0041309c.

First published (updated )
CVE-2022-29398

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN004196c8.

First published (updated )
CVE-2022-29397
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN00418f10.

First published (updated )
CVE-2022-29396

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the apcliKey p…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the apcliKey parameter in the function FUN0041bac4.

First published (updated )
CVE-2022-29395

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macAddress…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the macAddress parameter in the function FUN0041b448.

First published (updated )
CVE-2022-29394

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN004192cc.

First published (updated )
CVE-2022-29393

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN004200c8.

First published (updated )
CVE-2022-29391
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK N600R firmwareTOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa…

Risk 87
Severity
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN00418c24.

First published (updated )
CVE-2022-29392

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.

First published (updated )
CVE-2022-28913

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.

First published (updated )
CVE-2022-28912

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName.

First published (updated )
CVE-2022-28910

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate.

First published (updated )
CVE-2022-28911
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx.

First published (updated )
CVE-2022-28909

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.

First published (updated )
CVE-2022-28908

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost.

First published (updated )
CVE-2022-28907

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.

First published (updated )
CVE-2022-28906

TOTOLINK N600R firmwareOS Command Injection, Command Injection

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLink N600R V5.3c.7159B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName.

First published (updated )
CVE-2022-28905
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

TOTOLINK N600R firmwareCommand Injection

Risk 87
Severity
10
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R v5.3c.5507B20171031 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter in the "Main" function.

First published (updated )
CVE-2022-27411

TOTOLINK N600R firmwareCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7570B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.

First published (updated )
CVE-2022-26189

TOTOLINK N600R firmwareCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7570B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.

First published (updated )
CVE-2022-26188

TOTOLINK N600R firmwareCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7570B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.

First published (updated )
CVE-2022-26187

TOTOLINK N600R firmwareCommand Injection

Risk 86
Severity
9.8
Command Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

TOTOLINK N600R V4.3.0cu.7570B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.

First published (updated )
CVE-2022-26186
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203