Totolink N600R Firmware vulnerabilities
38 known vulnerabilities affecting totolink/n600r_firmware.
Total CVEs
38
CISA KEV
0
Public exploits
0
Exploited in wild
6
Severity breakdown
CRITICAL29HIGH7MEDIUM2
Vulnerabilities
Page 1 of 2
CVE-2022-26187P1CRITICALCVSS 9.8Exploitedv4.3.0cu.7570_b202006202022-03-22
CVE-2022-26187 [CRITICAL] CWE-77 CVE-2022-26187: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability v
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
nvd
CVE-2022-26186P1CRITICALCVSS 9.8Exploitedv4.3.0cu.7570_b202006202022-03-22
CVE-2022-26186 [CRITICAL] CWE-77 CVE-2022-26186: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability v
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.
nvd
CVE-2022-28906P1CRITICALCVSS 9.8Exploitedv5.3c.7159_b201904252022-05-10
CVE-2022-28906 [CRITICAL] CWE-78 CVE-2022-28906: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.
nvd
CVE-2022-28908P1CRITICALCVSS 9.8Exploitedv5.3c.7159_b201904252022-05-10
CVE-2022-28908 [CRITICAL] CWE-78 CVE-2022-28908: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.
nvd
CVE-2022-28907P1CRITICALCVSS 9.8Exploitedv5.3c.7159_b201904252022-05-10
CVE-2022-28907 [CRITICAL] CWE-78 CVE-2022-28907: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost.
nvd
CVE-2022-28912P1CRITICALCVSS 9.8Exploitedv5.3c.7159_b201904252022-05-10
CVE-2022-28912 [CRITICAL] CWE-78 CVE-2022-28912: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.
nvd
CVE-2025-9935P2CRITICALCVSS 9.8v4.3.0cu.7866_b202205062025-09-04
CVE-2025-9935 [CRITICAL] CWE-74 CVE-2025-9935: A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects
A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
nvd
CVE-2025-51390P2CRITICALCVSS 9.8v4.3.0cu.7647_b202101062025-08-04
CVE-2025-51390 [CRITICAL] CWE-78 CVE-2025-51390: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability v
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.
nvd
CVE-2025-4496P2CRITICALCVSS 9.8v4.1.8cu.5241_b202109272025-05-10
CVE-2025-4496 [CRITICAL] CWE-119 CVE-2025-4496: A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5
A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack can be initiated remotely. Th
nvd
CVE-2022-26189P2CRITICALCVSS 9.8v4.3.0cu.7570_b202006202022-03-22
CVE-2022-26189 [CRITICAL] CWE-77 CVE-2022-26189: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability v
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.
nvd
CVE-2022-27411P2CRITICALCVSS 9.8v5.3c.5507_b201710312022-05-05
CVE-2022-27411 [CRITICAL] CVE-2022-27411: TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via
TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter in the "Main" function.
nvd
CVE-2025-11444P2HIGHCVSS 8.8≤ 4.3.0cu.7866_b20225062025-10-08
CVE-2025-11444 [HIGH] CWE-119 CVE-2025-11444: A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impa
A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed p
nvd
CVE-2022-26188P2CRITICALCVSS 9.8v4.3.0cu.7570_b202006202022-03-22
CVE-2022-26188 [CRITICAL] CWE-77 CVE-2022-26188: TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability v
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.
nvd
CVE-2022-28905P2CRITICALCVSS 9.8v5.3c.7159_b201904252022-05-10
CVE-2022-28905 [CRITICAL] CWE-78 CVE-2022-28905: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName.
nvd
CVE-2022-28909P2CRITICALCVSS 9.8v5.3c.7159_b201904252022-05-10
CVE-2022-28909 [CRITICAL] CWE-78 CVE-2022-28909: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx.
nvd
CVE-2022-28910P2CRITICALCVSS 9.8v5.3c.7159_b201904252022-05-10
CVE-2022-28910 [CRITICAL] CWE-78 CVE-2022-28910: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName.
nvd
CVE-2022-28911P2CRITICALCVSS 9.8v5.3c.7159_b201904252022-05-10
CVE-2022-28911 [CRITICAL] CWE-78 CVE-2022-28911: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate.
nvd
CVE-2022-28913P2CRITICALCVSS 9.8v5.3c.7159_b201904252022-05-10
CVE-2022-28913 [CRITICAL] CWE-78 CVE-2022-28913: TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via
TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.
nvd
CVE-2022-29392P2CRITICALCVSS 9.8v4.3.0cu.7647_b202101062022-05-10
CVE-2022-29392 [CRITICAL] CWE-787 CVE-2022-29392: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_00418c24.
nvd
CVE-2022-29395P2CRITICALCVSS 9.8v4.3.0cu.7647_b202101062022-05-10
CVE-2022-29395 [CRITICAL] CWE-787 CVE-2022-29395: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the apcliKey p
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the apcliKey parameter in the function FUN_0041bac4.
nvd
1 / 2Next →