# cve.now: Totolink

The newest entries naming Totolink as an affected vendor (up to 200), of 557 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124060](https://cve.now/CVE-2026-124060.md): TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow (CVSS 9.4)
- [CVE-2026-124059](https://cve.now/CVE-2026-124059.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow (CVSS 9.4)
- [CVE-2026-124058](https://cve.now/CVE-2026-124058.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow (CVSS 9.4)
- [CVE-2026-124057](https://cve.now/CVE-2026-124057.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow (CVSS 9.4)
- [CVE-2026-123961](https://cve.now/CVE-2026-123961.md): TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow (CVSS 9.4)
- [CVE-2026-123960](https://cve.now/CVE-2026-123960.md): TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow (CVSS 9.4)
- [CVE-2026-123959](https://cve.now/CVE-2026-123959.md): TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow (CVSS 9.4)
- [CVE-2026-123958](https://cve.now/CVE-2026-123958.md): TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow (CVSS 9.4)
- [CVE-2026-123957](https://cve.now/CVE-2026-123957.md): TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow (CVSS 9.4)
- [CVE-2026-121600](https://cve.now/CVE-2026-121600.md): TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow (CVSS 9.4)
- [CVE-2026-121599](https://cve.now/CVE-2026-121599.md): TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow (CVSS 9.4)
- [CVE-2026-121598](https://cve.now/CVE-2026-121598.md): TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow (CVSS 9.4)
- [CVE-2026-121597](https://cve.now/CVE-2026-121597.md): TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow (CVSS 9.4)
- [CVE-2026-116508](https://cve.now/CVE-2026-116508.md): TOTOLINK A950RG Device-Information CGI infostat.cgi sub\_402340 stack-based overflow (CVSS 10.0)
- [CVE-2026-116507](https://cve.now/CVE-2026-116507.md): TOTOLINK A950RG global.so getLanguageCfg information disclosure (CVSS 6.9)
- [CVE-2026-116506](https://cve.now/CVE-2026-116506.md): TOTOLINK A950RG firewall.so apmib\_set command injection (CVSS 9.4)
- [CVE-2026-116505](https://cve.now/CVE-2026-116505.md): TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection (CVSS 9.4)
- [CVE-2026-116504](https://cve.now/CVE-2026-116504.md): TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection (CVSS 9.4)
- [CVE-2026-114575](https://cve.now/CVE-2026-114575.md): TOTOLINK A950RG product.so UploadCustomModule command injection (CVSS 10.0)
- [CVE-2026-114383](https://cve.now/CVE-2026-114383.md): TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow (CVSS 10.0)
- [CVE-2026-114382](https://cve.now/CVE-2026-114382.md): TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow (CVSS 10.0)
- [CVE-2026-35499](https://cve.now/CVE-2026-35499.md): An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250 (CVSS 9.1)
- [CVE-2026-40627](https://cve.now/CVE-2026-40627.md): An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B202 (CVSS 9.1)
- [CVE-2026-28763](https://cve.now/CVE-2026-28763.md): A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R (CVSS 9.1)
- [CVE-2026-41223](https://cve.now/CVE-2026-41223.md): A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-G (CVSS 9.1)
- [CVE-2026-33568](https://cve.now/CVE-2026-33568.md): A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0. (CVSS 9.1)
- [CVE-2026-41222](https://cve.now/CVE-2026-41222.md): A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh- (CVSS 9.1)
- [CVE-2026-40615](https://cve.now/CVE-2026-40615.md): A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R (version(s): TOTOLINK-X20 (CVSS 9.1)
- [CVE-2026-42020](https://cve.now/CVE-2026-42020.md): Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G (CVSS 9.1)
- [CVE-2026-42019](https://cve.now/CVE-2026-42019.md): Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-G (CVSS 9.1)
- [CVE-2026-42024](https://cve.now/CVE-2026-42024.md): Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X (CVSS 9.1)
- [CVE-2026-42023](https://cve.now/CVE-2026-42023.md): Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X (CVSS 9.1)
- [CVE-2026-42022](https://cve.now/CVE-2026-42022.md): Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X (CVSS 9.1)
- [CVE-2026-42021](https://cve.now/CVE-2026-42021.md): Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X (CVSS 9.1)
- [CVE-2026-42026](https://cve.now/CVE-2026-42026.md): Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp\_dns functionality of X2000R (version(s) (CVSS 9.1)
- [CVE-2026-42025](https://cve.now/CVE-2026-42025.md): Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp\_dns functionality of X2000R (version(s) (CVSS 9.1)
- [CVE-2026-9660](https://cve.now/CVE-2026-9660.md): Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X (CVSS 9.1)
- [CVE-2026-9659](https://cve.now/CVE-2026-9659.md): Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R (version(s): TOTOLINK-X (CVSS 9.1)
- [CVE-2026-9814](https://cve.now/CVE-2026-9814.md): An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2 (CVSS 9.1)
- [CVE-2026-9817](https://cve.now/CVE-2026-9817.md): A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0- (CVSS 9.1)
- [CVE-2026-9827](https://cve.now/CVE-2026-9827.md): A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B202504 (CVSS 9.1)
- [CVE-2026-9869](https://cve.now/CVE-2026-9869.md): A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0 (CVSS 9.1)
- [CVE-2026-10131](https://cve.now/CVE-2026-10131.md): An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20 (CVSS 9.1)
- [CVE-2026-10132](https://cve.now/CVE-2026-10132.md): A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B (CVSS 9.1)
- [CVE-2026-10133](https://cve.now/CVE-2026-10133.md): A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421. (CVSS 9.1)
- [CVE-2026-10135](https://cve.now/CVE-2026-10135.md): A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). (CVSS 9.1)
- [CVE-2026-10136](https://cve.now/CVE-2026-10136.md): A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20 (CVSS 9.1)
- [CVE-2026-10137](https://cve.now/CVE-2026-10137.md): A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B2 (CVSS 9.1)
- [CVE-2026-10138](https://cve.now/CVE-2026-10138.md): A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421 (CVSS 9.1)
- [CVE-2026-10139](https://cve.now/CVE-2026-10139.md): A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 (CVSS 9.1)
- [CVE-2026-10141](https://cve.now/CVE-2026-10141.md): A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421 (CVSS 9.1)
- [CVE-2026-105484](https://cve.now/CVE-2026-105484.md): TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware\_check os command injection (CVSS 10.0)
- [CVE-2026-105286](https://cve.now/CVE-2026-105286.md): Totolink A3002MU File Upload formUploadFile sub\_44B250 path traversal (CVSS 5.3)
- [CVE-2026-105285](https://cve.now/CVE-2026-105285.md): Totolink A3002MU QoS Rule formIpQoS stack-based overflow (CVSS 10.0)
- [CVE-2026-105284](https://cve.now/CVE-2026-105284.md): Totolink A3002MU Authentication Check boa sub\_40FCFC improper authorization (CVSS 10.0)
- [CVE-2026-100896](https://cve.now/CVE-2026-100896.md): TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection (CVSS 9.4)
- [CVE-2026-93742](https://cve.now/CVE-2026-93742.md): Totolink A3002MU formWsc command injection (CVSS 9.4)
- [CVE-2026-93741](https://cve.now/CVE-2026-93741.md): Totolink A3002MU formWlWds buffer overflow (CVSS 10.0)
- [CVE-2026-93740](https://cve.now/CVE-2026-93740.md): Totolink A3002MU formWlEncrypt buffer overflow (CVSS 10.0)
- [CVE-2026-93739](https://cve.now/CVE-2026-93739.md): Totolink A3002MU formWlAc buffer overflow (CVSS 9.4)
- [CVE-2026-93738](https://cve.now/CVE-2026-93738.md): Totolink A3002MU formSchedule buffer overflow (CVSS 9.4)
- [CVE-2026-91853](https://cve.now/CVE-2026-91853.md): TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection (CVSS 5.3)
- [CVE-2026-90608](https://cve.now/CVE-2026-90608.md): Totolink A3002MU boa formPortFw buffer overflow (CVSS 9.4)
- [CVE-2026-90607](https://cve.now/CVE-2026-90607.md): Totolink A3002MU boa formNewSchedule buffer overflow (CVSS 9.4)
- [CVE-2026-90606](https://cve.now/CVE-2026-90606.md): Totolink A3002MU boa formIpv6Setup buffer overflow (CVSS 9.4)
- [CVE-2026-90605](https://cve.now/CVE-2026-90605.md): Totolink A3002MU boa formFilter buffer overflow (CVSS 9.4)
- [CVE-2026-90604](https://cve.now/CVE-2026-90604.md): Totolink A3002MU Anchor Tag cross site scripting (CVSS 5.1)
- [CVE-2026-85031](https://cve.now/CVE-2026-85031.md): TOTOLINK CP450 cstecgi.cgi buffer overflow (CVSS 9.4)
- [CVE-2026-82616](https://cve.now/CVE-2026-82616.md): TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow (CVSS 9.4)
- [CVE-2026-82597](https://cve.now/CVE-2026-82597.md): TOTOLINK NR1800X cstecgi.cgi setUssd command injection (CVSS 5.3)
- [CVE-2026-82555](https://cve.now/CVE-2026-82555.md): TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values (CVSS 6.3)
- [CVE-2026-82539](https://cve.now/CVE-2026-82539.md): TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption (CVSS 9.4)
- [CVE-2026-79912](https://cve.now/CVE-2026-79912.md): TOTOLINK N600R cstecgi.cgi getCurrentTime command injection (CVSS 6.9)
- [CVE-2026-79911](https://cve.now/CVE-2026-79911.md): TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow (CVSS 10.0)
- [CVE-2026-75013](https://cve.now/CVE-2026-75013.md): TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference (CVSS 7.1)
- [CVE-2026-75012](https://cve.now/CVE-2026-75012.md): TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference (CVSS 7.1)
- [CVE-2026-19847](https://cve.now/CVE-2026-19847.md): TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow (CVSS 8.7)
- [CVE-2026-19846](https://cve.now/CVE-2026-19846.md): TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow (CVSS 8.7)
- [CVE-2026-19845](https://cve.now/CVE-2026-19845.md): TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow (CVSS 8.7)
- [CVE-2026-19844](https://cve.now/CVE-2026-19844.md): TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow (CVSS 8.7)
- [CVE-2026-19815](https://cve.now/CVE-2026-19815.md): TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow (CVSS 8.7)
- [CVE-2026-19814](https://cve.now/CVE-2026-19814.md): TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow (CVSS 8.7)
- [CVE-2026-19813](https://cve.now/CVE-2026-19813.md): TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow (CVSS 8.7)
- [CVE-2026-19812](https://cve.now/CVE-2026-19812.md): TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow (CVSS 8.7)
- [CVE-2026-19811](https://cve.now/CVE-2026-19811.md): TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow (CVSS 8.7)
- [CVE-2026-15701](https://cve.now/CVE-2026-15701.md): Totolink NR1800X lighttpd formLogout.htm Form\_Logout stack-based overflow (CVSS 9.3)
- [CVE-2026-15271](https://cve.now/CVE-2026-15271.md): TOTOLINK EX200 Web boa.conf least privilege violation (CVSS 7.7)
- [CVE-2026-15204](https://cve.now/CVE-2026-15204.md): TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal (CVSS 6.9)
- [CVE-2026-44089](https://cve.now/CVE-2026-44089.md): Buffer Overflow in Totolink EX1200L router (CVSS 9.4)
- [CVE-2026-11620](https://cve.now/CVE-2026-11620.md): TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation (CVSS 6.9)
- [CVE-2026-11554](https://cve.now/CVE-2026-11554.md): TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation (CVSS 5.3)
- [CVE-2026-11494](https://cve.now/CVE-2026-11494.md): TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation (CVSS 5.3)
- [CVE-2026-10187](https://cve.now/CVE-2026-10187.md): Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow (CVSS 9.3)
- [CVE-2026-9543](https://cve.now/CVE-2026-9543.md): Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection (CVSS 9.3)
- [CVE-2026-9534](https://cve.now/CVE-2026-9534.md): Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection (CVSS 5.3)
- [CVE-2026-9533](https://cve.now/CVE-2026-9533.md): Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection (CVSS 5.3)
- [CVE-2026-9532](https://cve.now/CVE-2026-9532.md): Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection (CVSS 5.3)
- [CVE-2026-9531](https://cve.now/CVE-2026-9531.md): Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection (CVSS 5.3)
- [CVE-2026-9515](https://cve.now/CVE-2026-9515.md): Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection (CVSS 5.3)
- [CVE-2026-9514](https://cve.now/CVE-2026-9514.md): Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection (CVSS 5.3)
- [CVE-2026-9513](https://cve.now/CVE-2026-9513.md): Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection (CVSS 5.3)
- [CVE-2026-9512](https://cve.now/CVE-2026-9512.md): Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection (CVSS 5.3)
- [CVE-2026-9511](https://cve.now/CVE-2026-9511.md): Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection (CVSS 5.3)
- [CVE-2026-9478](https://cve.now/CVE-2026-9478.md): Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection (CVSS 9.3)
- [CVE-2026-9477](https://cve.now/CVE-2026-9477.md): Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection (CVSS 9.3)
- [CVE-2026-9476](https://cve.now/CVE-2026-9476.md): Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection (CVSS 9.3)
- [CVE-2026-9475](https://cve.now/CVE-2026-9475.md): Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection (CVSS 9.3)
- [CVE-2026-9458](https://cve.now/CVE-2026-9458.md): Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection (CVSS 9.3)
- [CVE-2026-9457](https://cve.now/CVE-2026-9457.md): Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection (CVSS 9.3)
- [CVE-2026-9456](https://cve.now/CVE-2026-9456.md): Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection (CVSS 9.3)
- [CVE-2026-9455](https://cve.now/CVE-2026-9455.md): Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection (CVSS 9.3)
- [CVE-2026-9454](https://cve.now/CVE-2026-9454.md): Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection (CVSS 9.3)
- [CVE-2026-9436](https://cve.now/CVE-2026-9436.md): Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection (CVSS 9.3)
- [CVE-2026-9435](https://cve.now/CVE-2026-9435.md): Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection (CVSS 9.3)
- [CVE-2026-9434](https://cve.now/CVE-2026-9434.md): Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection (CVSS 9.3)
- [CVE-2026-9433](https://cve.now/CVE-2026-9433.md): Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection (CVSS 9.3)
- [CVE-2026-9432](https://cve.now/CVE-2026-9432.md): Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection (CVSS 9.3)
- [CVE-2026-9408](https://cve.now/CVE-2026-9408.md): Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection (CVSS 9.3)
- [CVE-2026-9407](https://cve.now/CVE-2026-9407.md): Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection (CVSS 9.3)
- [CVE-2026-9406](https://cve.now/CVE-2026-9406.md): Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection (CVSS 9.3)
- [CVE-2026-9405](https://cve.now/CVE-2026-9405.md): Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection (CVSS 9.3)
- [CVE-2026-9404](https://cve.now/CVE-2026-9404.md): Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection (CVSS 9.3)
- [CVE-2026-9388](https://cve.now/CVE-2026-9388.md): Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection (CVSS 9.3)
- [CVE-2026-9387](https://cve.now/CVE-2026-9387.md): Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection (CVSS 9.3)
- [CVE-2026-9386](https://cve.now/CVE-2026-9386.md): Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection (CVSS 9.3)
- [CVE-2026-9385](https://cve.now/CVE-2026-9385.md): Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection (CVSS 9.3)
- [CVE-2026-9384](https://cve.now/CVE-2026-9384.md): Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection (CVSS 9.3)
- [CVE-2026-8137](https://cve.now/CVE-2026-8137.md): Totolink X5000R formDdns sub\_458E40 buffer overflow (CVSS 8.7)
- [CVE-2026-7823](https://cve.now/CVE-2026-7823.md): Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection (CVSS 9.3)
- [CVE-2026-7750](https://cve.now/CVE-2026-7750.md): Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow (CVSS 8.7)
- [CVE-2026-7749](https://cve.now/CVE-2026-7749.md): Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow (CVSS 8.7)
- [CVE-2026-7748](https://cve.now/CVE-2026-7748.md): Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow (CVSS 8.7)
- [CVE-2026-7747](https://cve.now/CVE-2026-7747.md): Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow (CVSS 9.3)
- [CVE-2026-7721](https://cve.now/CVE-2026-7721.md): Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection (CVSS 5.3)
- [CVE-2026-7720](https://cve.now/CVE-2026-7720.md): Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection (CVSS 5.3)
- [CVE-2026-7719](https://cve.now/CVE-2026-7719.md): Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow (CVSS 9.3)
- [CVE-2026-7718](https://cve.now/CVE-2026-7718.md): Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection (CVSS 5.3)
- [CVE-2026-7717](https://cve.now/CVE-2026-7717.md): Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow (CVSS 8.7)
- [CVE-2026-7633](https://cve.now/CVE-2026-7633.md): Totolink N300RH cstecgi.cgi setUploadSetting file inclusion (CVSS 6.9)
- [CVE-2026-7548](https://cve.now/CVE-2026-7548.md): Totolink NR1800X cstecgi.cgi sub\_41A68C command injection (CVSS 8.7)
- [CVE-2026-7546](https://cve.now/CVE-2026-7546.md): Totolink NR1800X lighttpd find\_host\_ip stack-based overflow (CVSS 9.3)
- [CVE-2026-7538](https://cve.now/CVE-2026-7538.md): Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection (CVSS 9.3)
- [CVE-2026-7244](https://cve.now/CVE-2026-7244.md): Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection (CVSS 9.3)
- [CVE-2026-7243](https://cve.now/CVE-2026-7243.md): Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection (CVSS 9.3)
- [CVE-2026-7242](https://cve.now/CVE-2026-7242.md): Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection (CVSS 9.3)
- [CVE-2026-7241](https://cve.now/CVE-2026-7241.md): Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection (CVSS 9.3)
- [CVE-2026-7240](https://cve.now/CVE-2026-7240.md): Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection (CVSS 9.3)
- [CVE-2026-7219](https://cve.now/CVE-2026-7219.md): Totolink N300RT formIpQoS buffer overflow (CVSS 8.6)
- [CVE-2026-7218](https://cve.now/CVE-2026-7218.md): Totolink N300RT libapmib.so formWsc is\_cmd\_string\_valid buffer overflow (CVSS 8.6)
- [CVE-2026-7204](https://cve.now/CVE-2026-7204.md): Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection (CVSS 9.3)
- [CVE-2026-7203](https://cve.now/CVE-2026-7203.md): Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection (CVSS 9.3)
- [CVE-2026-7202](https://cve.now/CVE-2026-7202.md): Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection (CVSS 9.3)
- [CVE-2026-7156](https://cve.now/CVE-2026-7156.md): Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection (CVSS 9.3)
- [CVE-2026-7155](https://cve.now/CVE-2026-7155.md): Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection (CVSS 9.3)
- [CVE-2026-7154](https://cve.now/CVE-2026-7154.md): Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection (CVSS 9.3)
- [CVE-2026-7153](https://cve.now/CVE-2026-7153.md): Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection (CVSS 9.3)
- [CVE-2026-7152](https://cve.now/CVE-2026-7152.md): Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection (CVSS 9.3)
- [CVE-2026-7140](https://cve.now/CVE-2026-7140.md): Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection (CVSS 9.3)
- [CVE-2026-7139](https://cve.now/CVE-2026-7139.md): Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection (CVSS 9.3)
- [CVE-2026-7138](https://cve.now/CVE-2026-7138.md): Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection (CVSS 9.3)
- [CVE-2026-7137](https://cve.now/CVE-2026-7137.md): Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection (CVSS 9.3)
- [CVE-2026-7136](https://cve.now/CVE-2026-7136.md): Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection (CVSS 9.3)
- [CVE-2026-7125](https://cve.now/CVE-2026-7125.md): Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection (CVSS 9.3)
- [CVE-2026-7124](https://cve.now/CVE-2026-7124.md): Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection (CVSS 9.3)
- [CVE-2026-7123](https://cve.now/CVE-2026-7123.md): Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection (CVSS 9.3)
- [CVE-2026-7122](https://cve.now/CVE-2026-7122.md): Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection (CVSS 9.3)
- [CVE-2026-7121](https://cve.now/CVE-2026-7121.md): Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection (CVSS 9.3)
- [CVE-2026-7037](https://cve.now/CVE-2026-7037.md): Totolink A8000RU CGI cstecgi.cgi setVpnPassCfg os command injection (CVSS 9.3)
- [CVE-2026-6195](https://cve.now/CVE-2026-6195.md): Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection (CVSS 9.3)
- [CVE-2026-6194](https://cve.now/CVE-2026-6194.md): Totolink A3002MU HTTP Request formWlanSetup sub\_410188 stack-based overflow (CVSS 8.7)
- [CVE-2026-6168](https://cve.now/CVE-2026-6168.md): TOTOLINK A7000R cstecgi.cgi setWiFiEasyGuestCfg stack-based overflow (CVSS 8.7)
- [CVE-2026-6158](https://cve.now/CVE-2026-6158.md): Totolink N300RH upgrade.so setUpgradeUboot os command injection (CVSS 6.9)
- [CVE-2026-6157](https://cve.now/CVE-2026-6157.md): Totolink A800R app.so setAppEasyWizardConfig buffer overflow (CVSS 8.7)
- [CVE-2026-6156](https://cve.now/CVE-2026-6156.md): Totolink A7100RU CGI cstecgi.cgi setIpQosRules os command injection (CVSS 9.3)
- [CVE-2026-6155](https://cve.now/CVE-2026-6155.md): Totolink A7100RU CGI cstecgi.cgi setWanCfg os command injection (CVSS 9.3)
- [CVE-2026-6154](https://cve.now/CVE-2026-6154.md): Totolink A7100RU CGI cstecgi.cgi setWizardCfg os command injection (CVSS 9.3)
- [CVE-2026-6140](https://cve.now/CVE-2026-6140.md): Totolink A7100RU CGI cstecgi.cgi UploadFirmwareFile os command injection (CVSS 9.3)
- [CVE-2026-6139](https://cve.now/CVE-2026-6139.md): Totolink A7100RU CGI cstecgi.cgi UploadOpenVpnCert os command injection (CVSS 9.3)
- [CVE-2026-6138](https://cve.now/CVE-2026-6138.md): Totolink A7100RU CGI cstecgi.cgi setAccessDeviceCfg os command injection (CVSS 9.3)
- [CVE-2026-6132](https://cve.now/CVE-2026-6132.md): Totolink A7100RU CGI cstecgi.cgi setLedCfg os command injection (CVSS 9.3)
- [CVE-2026-6131](https://cve.now/CVE-2026-6131.md): Totolink A7100RU CGI cstecgi.cgi setTracerouteCfg os command injection (CVSS 9.3)
- [CVE-2026-6116](https://cve.now/CVE-2026-6116.md): Totolink A7100RU CGI cstecgi.cgi setDiagnosisCfg os command injection (CVSS 9.3)
- [CVE-2026-6115](https://cve.now/CVE-2026-6115.md): Totolink A7100RU CGI cstecgi.cgi setAppCfg os command injection (CVSS 9.3)
- [CVE-2026-6114](https://cve.now/CVE-2026-6114.md): Totolink A7100RU CGI cstecgi.cgi setNetworkCfg os command injection (CVSS 9.3)
- [CVE-2026-6113](https://cve.now/CVE-2026-6113.md): Totolink A7100RU CGI cstecgi.cgi setTtyServiceCfg os command injection (CVSS 9.3)
- [CVE-2026-6112](https://cve.now/CVE-2026-6112.md): Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection (CVSS 9.3)
- [CVE-2026-6029](https://cve.now/CVE-2026-6029.md): Totolink A7100RU CGI cstecgi.cgi setVpnAccountCfg os command injection (CVSS 9.3)
- [CVE-2026-6028](https://cve.now/CVE-2026-6028.md): Totolink A7100RU CGI cstecgi.cgi setPptpServerCfg os command injection (CVSS 9.3)
- [CVE-2026-6027](https://cve.now/CVE-2026-6027.md): Totolink A7100RU CGI cstecgi.cgi setUrlFilterRules os command injection (CVSS 9.3)
- [CVE-2026-6026](https://cve.now/CVE-2026-6026.md): Totolink A7100RU CGI cstecgi.cgi setPortalConfWeChat os command injection (CVSS 9.3)
- [CVE-2026-6025](https://cve.now/CVE-2026-6025.md): Totolink A7100RU CGI cstecgi.cgi setSyslogCfg os command injection (CVSS 9.3)
- [CVE-2026-5997](https://cve.now/CVE-2026-5997.md): Totolink A7100RU CGI cstecgi.cgi setLoginPasswordCfg os command injection (CVSS 9.3)
- [CVE-2026-5996](https://cve.now/CVE-2026-5996.md): Totolink A7100RU CGI cstecgi.cgi setAdvancedInfoShow os command injection (CVSS 9.3)
- [CVE-2026-5995](https://cve.now/CVE-2026-5995.md): Totolink A7100RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection (CVSS 9.3)
- [CVE-2026-5994](https://cve.now/CVE-2026-5994.md): Totolink A7100RU CGI cstecgi.cgi setTelnetCfg os command injection (CVSS 9.3)
- [CVE-2026-5993](https://cve.now/CVE-2026-5993.md): Totolink A7100RU CGI cstecgi.cgi setWiFiGuestCfg os command injection (CVSS 9.3)
- [CVE-2026-5978](https://cve.now/CVE-2026-5978.md): Totolink A7100RU CGI cstecgi.cgi setWiFiAclRules os command injection (CVSS 9.3)
- [CVE-2026-5977](https://cve.now/CVE-2026-5977.md): Totolink A7100RU CGI cstecgi.cgi setWiFiBasicCfg os command injection (CVSS 9.3)
- [CVE-2026-5976](https://cve.now/CVE-2026-5976.md): Totolink A7100RU CGI cstecgi.cgi setStorageCfg os command injection (CVSS 9.3)
- [CVE-2026-5975](https://cve.now/CVE-2026-5975.md): Totolink A7100RU CGI cstecgi.cgi setDmzCfg os command injection (CVSS 9.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/totolink
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.