Vulnerabilities > Totolink

DATE CVE VULNERABILITY TITLE RISK
2023-02-03 CVE-2023-24144 Command Injection vulnerability in Totolink Ca300-Poe Firmware 6.2C.884
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.
network
low complexity
totolink CWE-77
critical
 9.8
9.8
2023-02-03 CVE-2023-24145 Command Injection vulnerability in Totolink Ca300-Poe Firmware 6.2C.884
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
network
low complexity
totolink CWE-77
critical
 9.8
9.8
2023-02-03 CVE-2023-24146 Command Injection vulnerability in Totolink Ca300-Poe Firmware 6.2C.884
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function.
network
low complexity
totolink CWE-77
critical
 9.8
9.8
2023-02-03 CVE-2023-24147 Use of Hard-coded Credentials vulnerability in Totolink Ca300-Poe Firmware 6.2C.884
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini.
network
low complexity
totolink CWE-798
7.5
7.5
2023-02-03 CVE-2023-24148 Command Injection vulnerability in Totolink Ca300-Poe Firmware 6.2C.884
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
network
low complexity
totolink CWE-77
critical
 9.8
9.8
2023-02-03 CVE-2023-24149 Use of Hard-coded Credentials vulnerability in Totolink Ca300-Poe Firmware 6.2C.884
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.
network
low complexity
totolink CWE-798
critical
 9.8
9.8
2023-02-03 CVE-2023-24150 Command Injection vulnerability in Totolink T8 Firmware V4.1.5Cu
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
network
low complexity
totolink CWE-77
critical
 9.8
9.8
2023-02-03 CVE-2023-24151 Command Injection vulnerability in Totolink T8 Firmware V4.1.5Cu
A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
network
low complexity
totolink CWE-77
critical
 9.8
9.8
2023-02-03 CVE-2023-24152 Command Injection vulnerability in Totolink T8 Firmware V4.1.5Cu
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
network
low complexity
totolink CWE-77
critical
 9.8
9.8
2023-02-03 CVE-2023-24153 Command Injection vulnerability in Totolink T8 Firmware V4.1.5Cu
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
network
low complexity
totolink CWE-77
critical
 9.8
9.8