Totolink N600R Firmware vulnerabilities

CVE-2025-60336 [HIGH] CWE-476 CVE-2025-60336: A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allo A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

CVE-2025-60333 [HIGH] CWE-121 CVE-2025-60333: TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 par TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-60335 [HIGH] CWE-476 CVE-2025-60335: A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows att A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

CVE-2025-60334 [HIGH] CWE-121 CVE-2025-60334: TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parame TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-11444 [HIGH] CWE-119 CVE-2025-11444: A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impa A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed p

CVE-2025-57623 [MEDIUM] CWE-476 CVE-2025-57623: A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cau A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service.

CVE-2025-9935 [MEDIUM] CWE-74 CVE-2025-9935: A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2025-51390 [CRITICAL] CWE-78 CVE-2025-51390: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability v TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.

CVE-2025-8181 [HIGH] CWE-266 CVE-2025-8181: A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. T A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely.

CVE-2025-46060 [CRITICAL] CWE-120 CVE-2025-46060: Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to e Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component

CVE-2025-4496 [HIGH] CWE-119 CVE-2025-4496: A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5 A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack can be initiated remotely. The ex

CVE-2025-22900 [CRITICAL] CWE-121 CVE-2025-22900: Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMa Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function.

CVE-2025-22903 [MEDIUM] CWE-121 CVE-2025-22903: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parame TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig.

CVE-2023-43141 [CRITICAL] CWE-284 CVE-2023-43141: TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Contr TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.

CVE-2022-36613 [HIGH] CWE-798 CVE-2022-36613: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /e TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

CVE-2022-29392 [CRITICAL] CWE-787 CVE-2022-29392: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_00418c24.

CVE-2022-28905 [CRITICAL] CWE-78 CVE-2022-28905: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName.

CVE-2022-29395 [CRITICAL] CWE-787 CVE-2022-29395: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the apcliKey p TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the apcliKey parameter in the function FUN_0041bac4.

CVE-2022-28912 [CRITICAL] CWE-78 CVE-2022-28912: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.

CVE-2022-29394 [CRITICAL] CWE-787 CVE-2022-29394: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macAddress TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macAddress parameter in the function FUN_0041b448.