Totolink vulnerabilities, page 3
1,303 vulnerabilities
Known vulnerabilities in Totolink products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 90 products.
CVE-2018-13310totolinka3002ru_firmware
EPSS score0.67%
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username.CVE-2018-13316totolinka3002ru_firmwareEPSS score3.19%
System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter.CVE-2018-13308totolinka3002ru_firmwareEPSS score0.69%
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field.CVE-2018-13309totolinka3002ru_firmwareEPSS score0.71%
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password.CVE-2018-13312totolinka3002ru_firmwareEPSS score0.69%
Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field.CVE-2021-42875totolinkex1200t_firmwareEPSS score4.10%
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.CVE-2021-42885totolinkex1200t_firmwareEPSS score2.43%
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to attack.CVE-2021-42872totolinkex1200t_firmwareEPSS score6.49%
TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.CVE-2021-42886totolinkex1200t_firmwareEPSS score2.10%
TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file.CVE-2021-42888totolinkex1200t_firmwareEPSS score1.90%
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to attack.CVE-2021-42877totolinkex1200t_firmwareEPSS score1.70%
TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.CVE-2021-42891totolinkex1200t_firmwareEPSS score1.43%
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization.CVE-2021-42892totolinkex1200t_firmwareEPSS score0.73%
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware.CVE-2021-42884totolinkex1200t_firmwareEPSS score2.43%
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack.CVE-2021-42887totolinkex1200t_firmwareEPSS score44.29%
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.CVE-2021-42893totolinkex1200t_firmwareEPSS score1.43%
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg.CVE-2021-42890totolinkex1200t_firmwareEPSS score1.90%
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime to attack.CVE-2021-42889totolinkex1200t_firmwareEPSS score1.43%
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization.CVE-2021-43711totolinkex200EPSS score37.84%
The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter name can be constructed for unauthenticated command execution.CVE-2021-43662totolinka720r_firmware+1EPSS score0.55%
totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption.