Totolink A720R Firmware vulnerabilities

CVE-2021-45737 [HIGH] CVE-2021-45737: TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login f TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter.

CVE-2021-45739 [HIGH] CVE-2021-45739: TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login f TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter.

CVE-2025-4268 [MEDIUM] CWE-287 CVE-2025-4268: A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulner A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input RebootSystem leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and

CVE-2025-4269 [MEDIUM] CWE-266 CVE-2025-4269: A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affec A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be init

CVE-2025-4271 [MEDIUM] CWE-200 CVE-2025-4271: A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affect A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclos

CVE-2025-60685 [MEDIUM] CWE-121 CVE-2025-60685: A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within t A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat co

CVE-2025-60686 [MEDIUM] CWE-121 CVE-2025-60686: A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binarie A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents of /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers witho

CVE-2021-43662 [MEDIUM] CWE-770 CVE-2021-43662: totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue whi totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption.