Vulnerabilities > Totolink > Critical

DATE CVE VULNERABILITY TITLE RISK
2023-10-25 CVE-2023-46560 Out-of-bounds Write vulnerability in Totolink X2000R Firmware 1.0.0B20230221.0948
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.
network
low complexity
totolink CWE-787
critical
9.8
2023-10-25 CVE-2023-46562 Out-of-bounds Write vulnerability in Totolink X2000R Firmware 1.0.0B20230221.0948
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.
network
low complexity
totolink CWE-787
critical
9.8
2023-10-25 CVE-2023-46563 Out-of-bounds Write vulnerability in Totolink X2000R Firmware 1.0.0B20230221.0948
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.
network
low complexity
totolink CWE-787
critical
9.8
2023-10-25 CVE-2023-46564 Out-of-bounds Write vulnerability in Totolink X2000R Firmware 1.0.0B20230221.0948
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.
network
low complexity
totolink CWE-787
critical
9.8
2023-10-25 CVE-2023-46574 Command Injection vulnerability in Totolink A3700R Firmware 9.1.2U.616520211012
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.
network
low complexity
totolink CWE-77
critical
9.8
2023-10-16 CVE-2023-45984 Out-of-bounds Write vulnerability in Totolink A7000R Firmware and X5000R Firmware
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
network
low complexity
totolink CWE-787
critical
9.8
2023-10-16 CVE-2023-36950 Out-of-bounds Write vulnerability in Totolink A7000R Firmware and X5000R Firmware
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
network
low complexity
totolink CWE-787
critical
9.8
2023-10-16 CVE-2023-36953 Command Injection vulnerability in Totolink Cp300+ Firmware 5.2Cu.7594B20200910
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
network
low complexity
totolink CWE-77
critical
9.8
2023-10-16 CVE-2023-36954 Command Injection vulnerability in Totolink Cp300+ Firmware 5.2Cu.7594B20200910
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
network
low complexity
totolink CWE-77
critical
9.8
2023-10-16 CVE-2023-36955 Out-of-bounds Write vulnerability in Totolink Cp300+ Firmware 5.2Cu.7594/5.2Cu.7594B20200910
TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
network
low complexity
totolink CWE-787
critical
9.8