Totolink N600R Firmware vulnerabilities

CVE-2022-29394 [CRITICAL] CWE-787 CVE-2022-29394: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macAddress TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macAddress parameter in the function FUN_0041b448.

CVE-2022-29396 [CRITICAL] CWE-787 CVE-2022-29396: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_00418f10.

CVE-2022-29393 [CRITICAL] CWE-787 CVE-2022-29393: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_004192cc.

CVE-2022-29397 [CRITICAL] CWE-787 CVE-2022-29397: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_004196c8.

CVE-2022-29391 [CRITICAL] CWE-787 CVE-2022-29391: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment pa TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_004200c8.

CVE-2025-22900 [CRITICAL] CWE-121 CVE-2025-22900: Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMa Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function.

CVE-2022-29399 [CRITICAL] CWE-787 CVE-2022-29399: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the url parame TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN_00415bf0.

CVE-2022-29398 [CRITICAL] CWE-787 CVE-2022-29398: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the File param TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN_0041309c.

CVE-2025-46060 [CRITICAL] CWE-120 CVE-2025-46060: Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to e Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component

CVE-2023-43141 [CRITICAL] CWE-284 CVE-2023-43141: TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Contr TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.

CVE-2025-8181 [HIGH] CWE-266 CVE-2025-8181: A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. T A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least privilege violation. It is possible to initiate the attack remotely.

CVE-2025-60335 [HIGH] CWE-476 CVE-2025-60335: A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows att A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

CVE-2025-60334 [HIGH] CWE-121 CVE-2025-60334: TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parame TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2025-60333 [HIGH] CWE-121 CVE-2025-60333: TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 par TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.

CVE-2022-36613 [HIGH] CWE-798 CVE-2022-36613: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /e TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

CVE-2025-60336 [HIGH] CWE-476 CVE-2025-60336: A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allo A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

CVE-2025-22903 [MEDIUM] CWE-121 CVE-2025-22903: TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parame TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig.

CVE-2025-57623 [MEDIUM] CWE-476 CVE-2025-57623: A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cau A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service.