Totolink A7000R vulnerabilities
36 vulnerabilities
Known vulnerabilities in Totolink A7000R, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-63461totolinka7000r_firmware
EPSS score0.41%
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-63460totolinka7000r_firmwareEPSS score0.41%
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-63154totolinka7000r_firmwareEPSS score0.40%
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.CVE-2025-63459totolinka7000r_firmwareEPSS score0.41%
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-63153totolinka7000r_firmwareEPSS score0.40%
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-63462totolinka7000r_firmwareEPSS score0.41%
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-51452totolinka7000r_firmwareEPSS score0.39%
In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.CVE-2022-37075totolinka7000r_firmwareEPSS score0.34%
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg.CVE-2022-37077totolinka7000r_firmwareEPSS score0.34%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the pppoeUser parameter.CVE-2022-37083totolinka7000r_firmwareEPSS score1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg.CVE-2022-37076totolinka7000r_firmwareEPSS score1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.CVE-2022-37081totolinka7000r_firmwareEPSS score1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg.CVE-2022-37082totolinka7000r_firmwareEPSS score1.01%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the function NTPSyncWithHost.CVE-2022-37078totolinka7000r_firmwareEPSS score0.87%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the lang parameter at /setting/setLanguageCfg.CVE-2022-37079totolinka7000r_firmwareEPSS score1.20%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.CVE-2022-37080totolinka7000r_firmwareEPSS score0.34%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the command parameter at setting/setTracerouteCfg.CVE-2022-37084totolinka7000r_firmwareEPSS score0.34%
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the sPort parameter at the addEffect function.CVE-2022-27003totolinka7000r_firmware+1EPSS score2.90%
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.CVE-2022-27005totolinka7000r_firmware+1EPSS score5.46%
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.CVE-2022-27004totolinka7000r_firmware+1EPSS score2.90%
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.