Browse CVEs

MEDIUM 6.1 CVE-2021-34207 Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScr… A3002r Firmware No fix yet Fix from $1,6002021-08-20 MEDIUM 6.1 CVE-2021-34215 Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary Jav… A3002r Firmware No fix yet Fix from $1,6002021-08-20 MEDIUM 6.1 CVE-2021-34220 Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary … A3002r Firmware No fix yet Fix from $1,6002021-08-20 MEDIUM 6.1 CVE-2021-34223 Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary Ja… A3002r Firmware No fix yet Fix from $1,6002021-08-20 MEDIUM 6.1 CVE-2021-34228EPSS 29% Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitra… A3002r Firmware No fix yet Fix from $1,6002021-08-20 MEDIUM 5.3 CVE-2021-34218 Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, and /mobile… A3002r Firmware No fix yet Fix from $1,6002021-08-20 CRITICAL 9.8 CVE-2021-35324EPSS 10% A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication. A720r Firmware No fix yet Fix from $2,3002021-08-05 CRITICAL 9.8 CVE-2021-35327 A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default cre… A720r Firmware No fix yet Fix from $2,3002021-08-05 HIGH 7.5 CVE-2021-35325EPSS 13% A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service… A720r Firmware No fix yet Fix from $1,9502021-08-05 HIGH 7.5 CVE-2021-35326 A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a craft… A720r Firmware No fix yet Fix from $1,9502021-08-05 CRITICAL 9.8 CVE-2021-27710EPSS 8% Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allo… X5000r Firmware No fix yet Fix from $2,3002021-04-14 CRITICAL 9.8 CVE-2021-27708EPSS 8% Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allo… X5000r Firmware No fix yet Fix from $2,3002021-04-14 MEDIUM 5.5 CVE-2020-27368 Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Para… A702r Firmware No fix yet Fix from $1,6002021-01-14 HIGH 8.8 CVE-2020-25499 TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality… A3002r Firmware 1.0.0-b20201028.1743 / 1.0.0-b20201103.1713+ Fix from $1,9502020-12-09 CRITICAL 9.8 CVE-2015-9551 An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Executio… A850r V1 Firmware 1.0.1-b20150707.1612 / 1.1-b20150708.1559+ Fix from $2,3002020-11-24 HIGH 7.5 CVE-2015-9550 An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. By sending a specific hel,xas… A850r V1 Firmware 1.0.1-b20150707.1612 / 1.1-b20150708.1559+ Fix from $1,9502020-11-24 MEDIUM 6.5 CVE-2018-13313 In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contai… A3002ru Firmware No fix yet Fix from $1,6002020-02-24 HIGH 8.8 CVE-2019-19824EPSS 25% On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/for… A3002ru Firmware after 4.0.0 Fix from $1,9502020-01-27 HIGH 7.5 CVE-2019-19822EPSS 9% A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configurati… A3002ru Firmware after 2019-12-12 Fix from $1,9502020-01-27 HIGH 7.5 CVE-2019-19823EPSS 6% A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash … A3002ru Firmware after 2019-12-12 Fix from $1,9502020-01-27 CRITICAL 9.8 CVE-2019-19825EPSS 30% On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin… A3002ru Firmware after 4.0.0 Fix from $2,3002020-01-27 CRITICAL 9.8 CVE-2018-13306 System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter. A3002ru Firmware No fix yet Fix from $2,3002018-11-27 CRITICAL 9.8 CVE-2018-13307 System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST paramet… A3002ru Firmware No fix yet Fix from $2,3002018-11-27 CRITICAL 9.8 CVE-2018-13314 System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter. A3002ru Firmware No fix yet Fix from $2,3002018-11-27 CRITICAL 9.8 CVE-2018-13316 System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter. A3002ru Firmware No fix yet Fix from $2,3002018-11-27 CRITICAL 9.8 CVE-2018-13311 System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter. A3002ru Firmware Mitigation only Fix from $2,3002018-11-26 CRITICAL 9.8 CVE-2018-13315 Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthent… A3002ru Firmware No fix yet Fix from $2,3002018-11-26 MEDIUM 6.1 CVE-2018-13308 Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phra… A3002ru Firmware No fix yet Fix from $1,6002018-11-26 MEDIUM 6.1 CVE-2018-13309 Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password. A3002ru Firmware No fix yet Fix from $1,6002018-11-26 MEDIUM 6.1 CVE-2018-13310 Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username. A3002ru Firmware Mitigation only Fix from $1,6002018-11-26