totolink Vulnerabilities and Affected Products
Vulnerabilities associated with A3300R.
Products
Clear product- A8000RU50 vulnerabilities
- A7100RU42 vulnerabilities
- A3002RU33 vulnerabilities
- x2000r_firmware29 vulnerabilities
- A702R27 vulnerabilities
- x6000r_firmware27 vulnerabilities
- A3002R26 vulnerabilities
- x5000r_firmware26 vulnerabilities
- X1525 vulnerabilities
- A3300R20 vulnerabilities
- A3600R20 vulnerabilities
- EX1200T19 vulnerabilities
- a3600r_firmware17 vulnerabilities
- T616 vulnerabilities
- A3700R15 vulnerabilities
- ex200_firmware15 vulnerabilities
- N300RH15 vulnerabilities
- a3700r_firmware14 vulnerabilities
- AC1200 T814 vulnerabilities
- LR1200GB14 vulnerabilities
- LR35014 vulnerabilities
- N150RT14 vulnerabilities
- N200RE14 vulnerabilities
- cp45013 vulnerabilities
- ac1200_t8_firmware12 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-5679MEDIUM | Totolink A3300R cstecgi.cgi vsetTr069Cfg os command injectionA security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument stun_pass leads to os command injection. The exploit has been disclosed publicly and may be used. | CVSS5.1v4.0 | EPSS1.74% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5178MEDIUM | Totolink A3300R cstecgi.cgi setIptvCfg command injectionA security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this issue is the function setIptvCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument vlanPriLan3 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. | CVSS5.3v4.0 | EPSS3.66% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5177MEDIUM | Totolink A3300R cstecgi.cgi setWiFiBasicCfg command injectionA weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument rxRate can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. | CVSS5.3v4.0 | EPSS2.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5176MEDIUM | Totolink A3300R cstecgi.cgi setSyslogCfg command injectionA security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. Affected is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument provided results in command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. | CVSS6.9v4.0 | EPSS1.93% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5105MEDIUM | Totolink A3300R Parameter cstecgi.cgi setVpnPassCfg command injectionA vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. | CVSS5.3v4.0 | EPSS3.64% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5104MEDIUM | Totolink A3300R cstecgi.cgi setStaticRoute command injectionA security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Impacted is the function setStaticRoute of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ip leads to command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. | CVSS5.3v4.0 | EPSS2.48% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5103MEDIUM | Totolink A3300R cstecgi.cgi setUPnPCfg command injectionA weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. | CVSS5.3v4.0 | EPSS3.64% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5102MEDIUM | Totolink A3300R Parameter cstecgi.cgi setSmartQosCfg command injectionA security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument qos_up_bw results in command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. | CVSS5.3v4.0 | EPSS2.16% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-5101MEDIUM | Totolink A3300R Parameter cstecgi.cgi setLanCfg command injectionA vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. The manipulation of the argument lanIp leads to command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | CVSS5.3v4.0 | EPSS2.18% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12260HIGH | TOTOLINK A3300R POST Parameter cstecgi.cgi setSyslogCfg stack-based overflowA vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. Such manipulation of the argument enable leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | CVSS8.7v4.0 | EPSS0.943% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12259HIGH | TOTOLINK A3300R POST Parameter cstecgi.cgi setScheduleCfg stack-based overflowA flaw has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. This manipulation of the argument recHour causes stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been published and may be used. | CVSS8.7v4.0 | EPSS0.943% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12258HIGH | TOTOLINK A3300R POST Parameter cstecgi.cg setOpModeCfg stack-based overflowA vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. Impacted is the function setOpModeCfg of the file /cgi-bin/cstecgi.cg of the component POST Parameter Handler. The manipulation of the argument opmode results in stack-based buffer overflow. The attack may be performed from remote. | CVSS8.7v4.0 | EPSS0.943% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12241HIGH | TOTOLINK A3300R POST Parameter cstecgi.cgi setLanguageCfg stack-based overflowA vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. The manipulation of the argument lang results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. | CVSS8.7v4.0 | EPSS0.948% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12240HIGH | TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflowA security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. | CVSS8.7v4.0 | EPSS0.77% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-12239HIGH | TOTOLINK A3300R cstecgi.cgi setDdnsCfg buffer overflowA weakness has been identified in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi. Executing manipulation can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be exploited. | CVSS8.7v4.0 | EPSS0.77% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-7331HIGH | TOTOLINK A3300R cstecgi.cgi UploadCustomModule buffer overflowA vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-273254 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa… CWE-120Aug 1, 2024 | CVSS8.7v4.0 | EPSS1.2% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
TOTOLINK A3300R shadow.sample hard-coded passwordA vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-272569 was assigned to this v… | CVSS2.0v4.0 | EPSS0.251% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-24329CRITICAL | totolink a3300r_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function. | CVSS9.8v3.1 | EPSS6.17% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2023-37170CRITICAL | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function. CWE-78Jul 7, 2023 | CVSS9.8v3.1 | EPSS1.68% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-37171CRITICAL | TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function. CWE-78Jul 7, 2023 | CVSS9.8v3.1 | EPSS1.96% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |