Totolink Ex300 V2 Firmware vulnerabilities

6 known vulnerabilities affecting totolink/ex300_v2_firmware.

Total CVEs

6

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

CRITICAL1HIGH3MEDIUM2

Vulnerabilities

Page 1 of 1

CVE-2022-32449CRITICALCVSS 9.8v4.0.3c.74842022-07-07

CVE-2022-32449 [CRITICAL] CWE-77 CVE-2022-32449: TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the l TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vulnerability is exploitable via a crafted MQTT data packet.

CVE-2021-43663HIGHCVSS 7.5v4.0.3c.140_b202104292022-03-31

CVE-2021-43663 [HIGH] CWE-77 CVE-2021-43663: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check.

CVE-2021-43662MEDIUMCVSS 6.5v4.0.3c.140_b202104292022-03-31

CVE-2021-43662 [MEDIUM] CWE-770 CVE-2021-43662: totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue whi totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption.

CVE-2021-43661MEDIUMCVSS 6.1v4.0.3c.140_b202104292022-03-31

CVE-2021-43661 [MEDIUM] CWE-79 CVE-2021-43661: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting ( totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.

CVE-2022-25008HIGHCVSS 8.8v4.0.3c.140_b202104292022-03-30

CVE-2022-25008 [HIGH] CWE-306 CVE-2022-25008: totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an auth totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.

CVE-2021-43664HIGHCVSS 8.1v4.0.3c.140_b202104292022-03-30

CVE-2021-43664 [HIGH] CWE-77 CVE-2021-43664: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo.