Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,466 results · page 16 of 30
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.CVE-2024-57020 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "sMinute" parameter in setWiFiScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.CVE-2024-57019 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "limit" parameter in setVpnAccountCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.CVE-2024-57018 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "desc" parameter in setVpnAccountCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.CVE-2024-57017 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "pass" parameter in setVpnAccountCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.CVE-2024-57016 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.CVE-2024-57015 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "hour" parameter in setScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.CVE-2024-57014 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "recHour" parameter in setScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.CVE-2024-57013 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "switch" parameter in setScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.CVE-2024-57012 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "week" parameter in setScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 15, 2025TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.CVE-2024-57011 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an OS command injection vulnerability via the "minute" parameters in setScheduleCfg.
- Product
- X5000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 10, 2025TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.CVE-2024-57214 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
- Product
- A6000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_passwd function.CVE-2024-57213 · Other software · Totolink · reported by MITREMedium 6.3
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd parameter in the action_passwd function.
- Product
- A6000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reboot function.CVE-2024-57212 · Other software · Totolink · reported by MITREMedium 5.1
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the action_reboot function.
- Product
- A6000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function.CVE-2024-57211 · Other software · Totolink · reported by MITREHigh 8
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne parameter in the enable_wsh function.
- Product
- A6000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2024TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc.CVE-2024-54907 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK A3002R V4.0.0-B20230531.1404 is vulnerable to Remote Code Execution in /bin/boa via formWsc.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2024A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316.CVE-2024-12352 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This vulnerability affects the function sub_40662C of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- EX1800T
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2024An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-CVE-2024-51228 · Other software · totolink · reported by MITREMedium 6.8
An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.
- Product
- a3002ru_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering.CVE-2024-52723 · Other software · totolink · reported by MITRECritical 9.8
In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.
- Product
- x6000r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.CVE-2024-53335 · Other software · totolink · reported by MITREHigh 7.8
TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in downloadFlile.cgi.
- Product
- a810r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.CVE-2024-53334 · Other software · totolink · reported by MITREHigh 8.8
TOTOLINK A810R V4.1.2cu.5182_B20201026 is vulnerable to Buffer Overflow in infostat.cgi.
- Product
- a810r_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2024TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function.CVE-2024-53333 · Other software · totolink · reported by MITREMedium 6.3
TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to execute arbitrary commands via the "ussd" parameter.
- Product
- ex200_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2024An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll componCVE-2024-51141 · Other software · totolink · reported by MITREHigh 7.8
An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components.
- Product
- wifi_usb_driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2024A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329.CVE-2024-10966 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- X18
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical.CVE-2024-10654 · Other software · TOTOLINK · reported by VulDBMedium 6.9
A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 9.3.5u.6698_B20230810 is able to address this issue. It is recommended to upgrade the affected component.
- Product
- LR350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2024A vulnerability was found in TOTOLINK T10 4.1.8cu.5207.CVE-2024-9001 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter.CVE-2024-46419 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWizardCfg function via the ssid5g parameter.
- Product
- ac1200_t8_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.CVE-2024-46451 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter.
- Product
- ac1200_t8_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2024TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of SeCVE-2024-46424 · Other software · totolink · reported by MITREHigh 7.5
TOTOLINK AC1200 T8 v4.1.5cu.861_B20230220 has a buffer overflow vulnerability in the UploadCustomModule function, which allows attackers to cause a Denial of Service (DoS) via the File parameter.
- Product
- ac1200_t8_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2024A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5.CVE-2024-8869 · Other software · TOTOLINK · reported by VulDBLow 2.3
A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- A720R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220.CVE-2024-8580 · Other software · TOTOLINK · reported by VulDBCritical 9.2
A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This vulnerability affects unknown code of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability classified as critical has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220.CVE-2024-8579 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability classified as critical has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This affects the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220.CVE-2024-8578 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. It has been rated as critical. Affected by this issue is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument device_name leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207.CVE-2024-8577 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207.CVE-2024-8576 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been classified as critical. Affected is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical.CVE-2024-8575 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This issue affects the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical.CVE-2024-8574 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument slaveIpList leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2024A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207.CVE-2024-8573 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime/eTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow.CVE-2024-34195 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. In the boa server program's CGI handling function formWlEncrypt, there is a lack of length restriction on the wlan_ssid field. This oversight leads to potential buffer overflow under specific circumstances. For instance, by invoking the formWlanRedirect function with specific parameters to alter wlan_idx's value and subsequently invoking the formWlEncrypt function, an attacker can trigger buffer overflow, enabling arbitrary command execution or denial of service attacks.
- Product
- A3002r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2024TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow.CVE-2024-34198 · Other software · totolink · reported by MITRECritical 9.8
TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow. The formWlEncrypt CGI handler in the boa program fails to limit the length of the wlan_ssid field from user input. This allows attackers to craft malicious HTTP requests by supplying an excessively long value for the wlan_ssid field, leading to a stack overflow. This can be further exploited to execute arbitrary commands or launch denial-of-service attacks.
- Product
- a3002ru_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2024A vulnerability classified as critical has been found in TOTOLINK T10 AC1200 4.1.8cu.5207.CVE-2024-8162 · Other software · TOTOLINK · reported by VulDBCritical 9.3
A vulnerability classified as critical has been found in TOTOLINK T10 AC1200 4.1.8cu.5207. Affected is an unknown function of the file /squashfs-root/web_cste/cgi-bin/product.ini of the component Telnet Service. The manipulation leads to hard-coded credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- T10 AC1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228.CVE-2024-8079 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been rated as critical. This issue affects the function exportOvpn. The manipulation leads to buffer overflow. The attack may be initiated remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228.CVE-2024-8078 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been declared as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to buffer overflow. The attack can be initiated remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228.CVE-2024-8077 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been classified as critical. This affects the function setTracerouteCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical.CVE-2024-8076 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this issue is the function setDiagnosisCfg. The manipulation leads to buffer overflow. The attack may be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 22, 2024A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical.CVE-2024-8075 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg. The manipulation leads to os command injection. The attack can be launched remotely. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- AC1200 T8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024A vulnerability has been found in TOTOLINK EX1200L 9.3.5u.6146_B20201023 and classified as critical.CVE-2024-7909 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability has been found in TOTOLINK EX1200L 9.3.5u.6146_B20201023 and classified as critical. Affected by this vulnerability is the function setLanguageCfg of the file /www/cgi-bin/cstecgi.cgi. The manipulation of the argument langType leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EX1200L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023.CVE-2024-7908 · Other software · TOTOLINK · reported by VulDBHigh 8.7
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected is the function setDefResponse of the file /www/cgi-bin/cstecgi.cgi. The manipulation of the argument IpAddress leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- EX1200L
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2024A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719.CVE-2024-7907 · Other software · TOTOLINK · reported by VulDBMedium 5.3
A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719. This issue affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument rtLogServer leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- X6000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2024Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the pCVE-2024-42967 · Other software · totolink · reported by MITRECritical 9.8
Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.
- Product
- lr350_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2024Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the CVE-2024-42966 · Other software · totolink · reported by MITRECritical 9.8
Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh.
- Product
- n350rt_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.