Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,466 results · page 14 of 30
May 8, 2025TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function.CVE-2025-45842 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the setWiFiEasyCfg function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 8, 2025TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.CVE-2025-45841 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function.
- Product
- Nr1800x Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 5, 2025A vulnerability was found in TOTOLINK A720R 4.1.5cu.374.CVE-2025-4271 · Other software · TOTOLINK · reported by VulDBMedium 6.9
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability was found in TOTOLINK A720R 4.1.5cu.374.CVE-2025-4270 · Other software · TOTOLINK · reported by VulDBMedium 6.9
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical.CVE-2025-4269 · Other software · TOTOLINK · reported by VulDBMedium 6.9
A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical.CVE-2025-4268 · Other software · TOTOLINK · reported by VulDBMedium 6.9
A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input RebootSystem leads to missing authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2025TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, spCVE-2025-45800 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, specifically in the processing of the deviceMac parameter.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter.CVE-2025-44863 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca300-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter.CVE-2025-44862 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca300-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameterCVE-2025-44861 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca300-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter.CVE-2025-44860 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca300-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter.CVE-2025-44848 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter.CVE-2025-44847 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter.CVE-2025-44846 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter.CVE-2025-44845 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter.CVE-2025-44844 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameteCVE-2025-44843 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter.CVE-2025-44842 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version paraCVE-2025-44841 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameteCVE-2025-44840 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid paraCVE-2025-44839 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Ca600-poe Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameterCVE-2025-44838 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Cp900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or CVE-2025-44837 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Cp900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute paCVE-2025-44836 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Cp900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 1, 2025TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter.CVE-2025-44854 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- Product
- Cp900 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3996 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home.htm of the component MAC Filtering Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3995 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /boafrm/fromStaticDHCP of the component LAN Settings Page. The manipulation of the argument Hostname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3994 · Other software · TOTOLINK · reported by VulDBMedium 4.8
A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been classified as problematic. Affected is an unknown function of the file /home.htm of the component IP Port Filtering. The manipulation of the argument Comment leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical.CVE-2025-3993 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument submit-url leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability has been found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical.CVE-2025-3992 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability has been found in TOTOLINK N150RT 3.4.0-B20190525 and classified as critical. This vulnerability affects unknown code of the file /boafrm/formWlwds. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability, which was classified as critical, was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3991 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in TOTOLINK N150RT 3.4.0-B20190525. This affects an unknown part of the file /boafrm/formWdsEncrypt. The manipulation of the argument submit-url leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3990 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, has been found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this issue is some unknown functionality of the file /boafrm/formVlan. The manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability classified as critical was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3989 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical was found in TOTOLINK N150RT 3.4.0-B20190525. Affected by this vulnerability is an unknown functionality of the file /boafrm/formStaticDHCP. The manipulation of the argument Hostname leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3988 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK N150RT 3.4.0-B20190525. Affected is an unknown function of the file /boafrm/formPortFw. The manipulation of the argument service_type leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2025A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525.CVE-2025-3987 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability was found in TOTOLINK N150RT 3.4.0-B20190525. It has been rated as critical. This issue affects some unknown processing of the file /boafrm/formWsc. The manipulation of the argument localPin leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- N150RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2025TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain aCVE-2025-28028 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter.
- Product
- A830r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 23, 2025TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain aCVE-2025-28025 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
- Product
- A830r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 23, 2025TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.CVE-2025-28022 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
- Product
- A810r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 23, 2025TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parametersCVE-2025-28021 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters
- Product
- A810r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 23, 2025TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.CVE-2025-28020 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
- Product
- A800r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 23, 2025TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi componentCVE-2025-28019 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component
- Product
- A800r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 23, 2025TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.CVE-2025-28018 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
- Product
- A800r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.site
Apr 23, 2025TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter.CVE-2025-28017 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter.
- Product
- A800r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 22, 2025TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileNamCVE-2025-28039 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileName parameter.
- Product
- Ex1200t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 22, 2025TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWlaCVE-2025-28038 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWlanIdx parameter.
- Product
- Ex1200t Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 22, 2025TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrCVE-2025-28036 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 22, 2025TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrlCVE-2025-28035 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
- Product
- A830r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 22, 2025TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain aCVE-2025-28029 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgi
- Product
- A830r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 22, 2025TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a CVE-2025-28027 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi.
- Product
- A830r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Apr 22, 2025TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain aCVE-2025-28026 · Other software · Totolink · reported by MITREHigh 7.3
TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi.
- Product
- A830r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocrian-lightning-dc7.notion.sitelocrian-lightning-dc7.notion.site
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.