Totolink vulnerabilities
1,301 vulnerabilities
Known vulnerabilities in Totolink products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 90 products.
Products
50 of 90- A7100Ru77 vulnerabilities
- X5000R73 vulnerabilities
- A3300R65 vulnerabilities
- A3002R61 vulnerabilities
- X6000R59 vulnerabilities
- A8000Ru52 vulnerabilities
- A3002Ru49 vulnerabilities
- A3100R48 vulnerabilities
- X2000R45 vulnerabilities
- A3700R43 vulnerabilities
- N600R41 vulnerabilities
- T639 vulnerabilities
- Ex1200T37 vulnerabilities
- A7000R36 vulnerabilities
- Lr35036 vulnerabilities
- A950Rg34 vulnerabilities
- A800R33 vulnerabilities
- A702R32 vulnerabilities
- Nr1800X32 vulnerabilities
- Totolink30 vulnerabilities
- A720R29 vulnerabilities
- A810R29 vulnerabilities
- Ex1800T28 vulnerabilities
- A3000Ru26 vulnerabilities
- T826 vulnerabilities
- A3600R25 vulnerabilities
- A830R25 vulnerabilities
- X1525 vulnerabilities
- Ca300 Poe24 vulnerabilities
- Cp45022 vulnerabilities
- T1022 vulnerabilities
- Ex20021 vulnerabilities
- N200Re21 vulnerabilities
- N350Rt21 vulnerabilities
- N150Rt20 vulnerabilities
- Lr1200Gb19 vulnerabilities
- N300Rh15 vulnerabilities
- A3002Mu14 vulnerabilities
- Ac1200 T814 vulnerabilities
- Ex1200L14 vulnerabilities
- N300Rt14 vulnerabilities
- X1814 vulnerabilities
- A6000R13 vulnerabilities
- Cp90013 vulnerabilities
- Ca600 Poe10 vulnerabilities
- Ca750 Poe9 vulnerabilities
- A860R8 vulnerabilities
- Cp900L8 vulnerabilities
- Wa3008 vulnerabilities
- Cp300\+7 vulnerabilities
CVE-2026-9869totolinktotolinkA stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-9827totolinktotolinkA arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-9817totolinktotolinkA stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-9814totolinktotolinkAn OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-9660totolinktotolinkMultiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnPassword parameter.CVE-2026-9659totolinktotolinkMultiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability deals with the vpnUser parameter.CVE-2026-42026totolinktotolinkMultiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns2 parameter.CVE-2026-42025totolinktotolinkMultiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the dhcp_dns1 parameter.CVE-2026-42024totolinktotolinkMultiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_gw parameter.CVE-2026-42023totolinktotolinkMultiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_ipv6 parameter.CVE-2026-42022totolinktotolinkMultiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns2 parameter.CVE-2026-42021totolinktotolinkMultiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the static_dns1 parameter.CVE-2026-42020totolinktotolinkMultiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns2 parameter.CVE-2026-42019totolinktotolinkMultiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities. This vulnerability concerns the pppoe_dns1 parameter.CVE-2026-41223totolinktotolinkA stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-41222totolinktotolinkA stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-40627totolinktotolinkAn os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-40615totolinktotolinkA stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-35499totolinktotolinkAn os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.CVE-2026-33568totolinktotolinkA OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.