Totolink X6000R Firmware vulnerabilities

57 known vulnerabilities affecting totolink/x6000r_firmware.

Total CVEs
57
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL47HIGH6MEDIUM4

Vulnerabilities

Page 2 of 3
CVE-2023-48799CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-12-04
CVE-2023-48799 [CRITICAL] CVE-2023-48799: TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution. TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution.
nvd
CVE-2023-48800CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-12-04
CVE-2023-48800 [CRITICAL] CWE-78 CVE-2023-48800: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fiel In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
nvd
CVE-2023-48801CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-12-01
CVE-2023-48801 [CRITICAL] CWE-77 CVE-2023-48801: In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fiel In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability.
nvd
CVE-2023-43453CRITICALCVSS 9.8v9.4.0cu.652_b20230116v9.4.0cu.852_b202307192023-12-01
CVE-2023-43453 [CRITICAL] CWE-77 CVE-2023-43453: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attack An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP parameter of the setDiagnosisCfg component.
nvd
CVE-2023-43454CRITICALCVSS 9.8v9.4.0cu.652_b20230116v9.4.0cu.852_b202307192023-12-01
CVE-2023-43454 [CRITICAL] CWE-77 CVE-2023-43454: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attack An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hostName parameter of the switchOpMode component.
nvd
CVE-2023-43455CRITICALCVSS 9.8v9.4.0cu.652_b20230116v9.4.0cu.852_b202307192023-12-01
CVE-2023-43455 [CRITICAL] CWE-77 CVE-2023-43455: An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attack An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the command parameter of the setting/setTracerouteCfg component.
nvd
CVE-2023-48803CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48803 [CRITICAL] CWE-78 CVE-2023-48803: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48811CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48811 [CRITICAL] CWE-78 CVE-2023-48811: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48808CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48808 [CRITICAL] CWE-78 CVE-2023-48808: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48807CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48807 [CRITICAL] CWE-78 CVE-2023-48807: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48805CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48805 [CRITICAL] CWE-78 CVE-2023-48805: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48804CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48804 [CRITICAL] CWE-78 CVE-2023-48804: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48802CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48802 [CRITICAL] CWE-78 CVE-2023-48802: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48806CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48806 [CRITICAL] CWE-78 CVE-2023-48806: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48812CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48812 [CRITICAL] CWE-78 CVE-2023-48812: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from t In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function that when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-48810CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-11-30
CVE-2023-48810 [CRITICAL] CWE-78 CVE-2023-48810: In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end through Uci_ Set_ The Str function when passed to the CsteSystem function creates a command execution vulnerability.
nvd
CVE-2023-46979CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-10-31
CVE-2023-46979 [CRITICAL] CWE-77 CVE-2023-46979: TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability v TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function.
nvd
CVE-2023-46485CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-10-31
CVE-2023-46485 [CRITICAL] CWE-77 CVE-2023-46485: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary cod An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component.
nvd
CVE-2023-46484CRITICALCVSS 9.8v9.4.0cu.852_b202307192023-10-31
CVE-2023-46484 [CRITICAL] CWE-77 CVE-2023-46484: An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary cod An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.
nvd
CVE-2023-46978HIGHCVSS 7.5v9.4.0cu.852_b202307192023-10-31
CVE-2023-46978 [HIGH] CWE-306 CVE-2023-46978: TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication.
nvd
← Previous2 / 3Next →