Totolink Lr350 vulnerabilities, page 2
36 vulnerabilities
Known vulnerabilities in Totolink Lr350, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2024-7214totolink · lr350_firmwareTOTOLINK LR350 cstecgi.cgi setWanCfg command injectionA vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument hostName leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272785 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.EPSS3.15%CriticalCVE-2024-10654totolink · lr350_firmwareTOTOLINK LR350 formLoginAuth.htm authorizationA vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 9.3.5u.6698_B20230810 is able to address this issue. It is recommended to upgrade the affected component.EPSS1.55%HighCVE-2024-34308totolink · lr350_firmwaretotolink lr350_firmwareTOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode.EPSS0.56%CriticalCVE-2024-35099totolink · lr350_firmwaretotolink lr350_firmwareTOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth.EPSS0.84%CriticalCVE-2024-35387totolink · lr350_firmwaretotolink lr350_firmwareTOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.EPSS6.07%CriticalCVE-2026-1155totolink · lr350_firmwareTotolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflowA vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.EPSS0.94%HighCVE-2026-1149totolink · lr350_firmwareTotolink LR350 POST Request cstecgi.cgi setDiagnosisCfg command injectionA vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.EPSS3.04%CriticalCVE-2026-1156totolink · lr350_firmwareTotolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflowA vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.EPSS0.74%CriticalCVE-2026-1157totolink · lr350_firmwareTotolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflowA vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.EPSS1.01%CriticalCVE-2026-1158totolink · lr350_firmwareTotolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflowA security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.EPSS0.74%HighCVE-2026-1150totolink · lr350_firmwareTotolink LR350 POST Request cstecgi.cgi setTracerouteCfg command injectionA security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.EPSS2.64%CriticalCVE-2026-4976totolink · lr350_firmwareTotolink LR350 cstecgi.cgi setWiFiGuestCfg buffer overflowA vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.EPSS1.01%CriticalCVE-2023-37148totolink · lr350_firmwaretotolink lr350_firmwareTOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.EPSS1.96%CriticalCVE-2023-37145totolink · lr350_firmwaretotolink lr350_firmwareTOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.EPSS1.96%CriticalCVE-2023-37149totolink · lr350_firmwaretotolink lr350_firmwareTOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.EPSS1.96%CriticalCVE-2023-37146totolink · lr350_firmwaretotolink lr350_firmwareTOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.EPSS1.96%