Totolink vulnerabilities, page 5

1,303 vulnerabilities

Known vulnerabilities in Totolink products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 90 products.

7.8HighCVE-2021-45734totolink · x5000r_firmwaretotolink x5000r_firmwareTOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via the url parameter.EPSS1.47%7.8HighCVE-2021-45739totolink · a720r_firmwaretotolink a720r_firmwareTOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter.EPSS1.18%10CriticalCVE-2021-45738totolink · x5000r_firmwaretotolink x5000r_firmwareTOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.EPSS4.39%7.8HighCVE-2021-45736totolink · x5000r_firmwaretotolink x5000r_firmwareTOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a stack overflow in the function setL2tpServerCfg. This vulnerability allows attackers to cause a Denial of Service (DoS) via the eip, sip, server parameters.EPSS1.18%6.1MediumCVE-2021-34220totolink · a3002r_firmwaretotolink a3002r_firmwareCross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "User Name" field or "Password" field.EPSS0.66%6.1MediumCVE-2021-34223totolink · a3002r_firmwaretotolink a3002r_firmwareCross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field.EPSS0.66%6.1MediumCVE-2021-34215totolink · a3002r_firmwaretotolink a3002r_firmwareCross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Service Name" field.EPSS0.66%6.1MediumCVE-2021-34228totolink · a3002r_firmwaretotolink a3002r_firmwareCross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field.EPSS29.16%6.1MediumCVE-2021-34207totolink · a3002r_firmwaretotolink a3002r_firmwareCross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Domain Name" field, "Server Address" field, "User Name/Email", or "Password/Key" field.EPSS0.66%5.3MediumCVE-2021-34218totolink · a3002r_firmwaretotolink a3002r_firmwareDirectory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile directories via GET Parameter.EPSS0.81%7.5HighCVE-2021-35325totolink · a720r_firmwaretotolink a720r_firmwareA stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).EPSS13.31%9.8CriticalCVE-2021-35324totolink · a720r_firmwaretotolink a720r_firmwareA vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.EPSS10.42%7.5HighCVE-2021-35326totolink · a720r_firmwaretotolink a720r_firmwareA vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request.EPSS2.54%9.8CriticalCVE-2021-35327totolink · a720r_firmwaretotolink a720r_firmwareA vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request.EPSS1.38%7.5HighCVE-2015-9550totolink · a850r-v1_firmware +7 moretotolink a850r-v1_firmwareAn issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. By sending a specific hel,xasf packet to the WAN interface, it is possible to open the web management interface on the WAN interface.EPSS1.55%10CriticalCVE-2015-9551totolink · a850r-v1_firmware +7 moretotolink a850r-v1_firmwareAn issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Execution in the management interface via the formSysCmd sysCmd parameter.EPSS4.40%7.5HighCVE-2025-63461totolink · a7000r_firmwaretotolink a7000r_firmwareTotolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.41%7.5HighCVE-2025-63463totolink · lr350_firmwaretotolink lr350_firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.41%7.5HighCVE-2025-63465totolink · lr350_firmwaretotolink lr350_firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.41%7.5HighCVE-2025-63467totolink · lr350_firmwaretotolink lr350_firmwareTotolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_425400 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.EPSS0.41%