Totolink

An OS command injection vulnerability in the TOTOLINK X2000R router allows an authenticated attacker to execute arbitrary system commands via the boa formPasswordSetup function.

An authenticated remote attacker can trigger a stack-based buffer overflow in the TOTOLINK A800R router via the setIpQosRules function, potentially leading to arbitrary code execution.

A remote command injection vulnerability (CVE-2026-9385) exists in the setTracerouteCfg function of the web management interface in Totolink A8000RU 7.1cu.643_b20200521, allowing unauthenticated attackers to execute arbitrary commands on the device.

A remote command injection vulnerability exists in the Totolink A8000RU router, specifically in the setAppFilterCfg function, allowing attackers to execute arbitrary commands by manipulating the 'enable' argument.

A buffer overflow vulnerability exists in Totolink WA300 version 5.2cu.7112_B20190227 within the loginauth function of the /cgi-bin/cstecgi.cgi file, specifically affecting the POST Request Handler component, triggerable via manipulation of the http_host argument, and remotely exploitable with a publicly available exploit.

A remote OS command injection vulnerability exists in the setOpenVpnClientCfg function of the Totolink A8000RU router (version 7.1cu.643_b20200521) via manipulation of the 'enabled' argument in the /cgi-bin/cstecgi.cgi CGI handler.

CVE-2026-7240 is a critical OS command injection vulnerability in the Totolink A8000RU router that allows remote attackers to execute arbitrary commands by manipulating the 'User' argument in the 'setVpnAccountCfg' function.

CVE-2026-7155 is a critical OS command injection vulnerability in the Totolink A8000RU router that allows remote attackers to execute arbitrary commands by manipulating the 'admpass' argument in the setLoginPasswordCfg function.

CVE-2026-7152 is a critical OS command injection vulnerability in the Totolink A8000RU router that allows remote attackers to execute arbitrary commands by manipulating the telnet_enabled argument in the setTelnetCfg function.

A stack-based buffer overflow vulnerability (CVE-2026-6194) exists in the Totolink A3002MU B20211125.1046 router firmware, specifically affecting the `/boafrm/formWlanSetup` component's HTTP request handler, which allows remote attackers to execute arbitrary code by manipulating the `wan-url` argument.

A stack-based buffer overflow vulnerability (CVE-2026-6168) exists in TOTOLINK A7000R devices up to version 9.1.0u.6115, allowing remote attackers to execute arbitrary code via a crafted ssid5g argument to the setWiFiEasyGuestCfg function in /cgi-bin/cstecgi.cgi.

Totolink A7100RU version 7.4cu.2313_b20191024 is vulnerable to command injection due to improper neutralization of special elements within the setLedCfg function in the /cgi-bin/cstecgi.cgi file, allowing a remote attacker to execute arbitrary commands.

A command injection vulnerability exists in Totolink A7100RU firmware version 7.4cu.2313_b20191024, allowing remote attackers to execute arbitrary OS commands by manipulating the 'tz' argument in the setNtpCfg function within the /cgi-bin/cstecgi.cgi file.

A remote, unauthenticated attacker can bypass authentication on Totolink A8000R routers running firmware version 5.9c.681_B20180413 by manipulating the `langType` argument in the `setLanguageCfg` function of the `/cgi-bin/cstecgi.cgi` file.

A remote OS command injection vulnerability (CVE-2026-5677) exists in the CsteSystem function of the /cgi-bin/cstecgi.cgi file in Totolink A7100RU firmware version 7.4cu.2313_b20191024 due to improper handling of the resetFlags argument.

A command injection vulnerability (CVE-2026-5176) exists in the setSyslogCfg function of the Totolink A3300R router version 17.0.0cu.557_b20221024, allowing remote attackers to execute arbitrary commands by manipulating arguments in the /cgi-bin/cstecgi.cgi file.

A buffer overflow vulnerability in Totolink LR350 version 9.3.5u.6369_B20220309 allows a remote attacker to execute arbitrary code by manipulating the 'ssid' argument in the setWiFiGuestCfg function.

A remote command injection vulnerability exists in TOTOLINK X6000R routers, specifically versions 9.4.0cu.1360_B20241207 and 9.4.0cu.1498_B20250826, allowing attackers to execute arbitrary commands via manipulation of the Hostname argument in the setLanCfg function.

A remote OS command injection vulnerability exists in Totolink A8000RU version 7.1cu.643_b20200521 via manipulation of the 'proto' argument in the /cgi-bin/cstecgi.cgi CGI handler, potentially leading to complete system compromise.

CVE-2026-6025 allows a remote attacker to inject OS commands into a Totolink A7100RU router by manipulating the 'enable' argument of the setSyslogCfg function within the /cgi-bin/cstecgi.cgi CGI handler, potentially leading to complete system compromise.