Totolink Cp900L vulnerabilities

8 vulnerabilities

Known vulnerabilities in Totolink Cp900L, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2024-35395totolinkcp900l_firmware
EPSS score
0.44%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root.9.8CVE-2024-35398totolinkcp900l_firmware
EPSS score
0.57%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setMacFilterRules.2.7CVE-2024-35403totolinkcp900l_firmware
EPSS score
0.44%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function setIpPortFilterRules8.8CVE-2024-35399totolinkcp900l_firmware
EPSS score
0.43%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the password parameter in the function loginAuth8.8CVE-2024-35397totolinkcp900l_firmware
EPSS score
15.10%
TOTOLINK CP900L v4.1.5cu.798_B20221228 weas discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.5.3CVE-2024-35400totolinkcp900l_firmware
EPSS score
0.47%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a stack overflow via the desc parameter in the function SetPortForwardRules9.8CVE-2024-35396totolinkcp900l_firmware
EPSS score
0.54%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password for telnet in /web_cste/cgi-bin/product.ini, which allows attackers to log in as root.5.9CVE-2024-35401totolinkcp900l_firmware
EPSS score
0.60%
TOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.