Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,466 results · page 9 of 30
Feb 17, 2026TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter funcCVE-2026-26732 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter function.
- Product
- A3002ru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2026TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function.CVE-2026-26731 · Other software · Totolink · reported by MITREHigh 8.8
TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function.
- Product
- A3002ru Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2026A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227.CVE-2026-2167 · Other software · Totolink · reported by VulDBLow 2.1
A vulnerability was detected in Totolink WA300 5.2cu.7112_B20190227. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. The attack may be performed from remote. The exploit is now public and may be used.
- Product
- WA300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112.CVE-2025-67189 · Other software · Totolink · reported by MITREMedium 6.5
A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly validated, and the function concatenates multiple user-controlled fields into a fixed-size stack buffer without performing boundary checks. A remote attacker can exploit this flaw to cause denial of service or potentially achieve arbitrary code execution.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112.CVE-2025-67188 · Other software · Totolink · reported by MITRECritical 9.8
A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg interface of the /lib/cste_modules/ipv6.so module. The function fails to properly validate the length of the user-controlled radvdinterfacename parameter, allowing remote attackers to trigger a stack buffer overflow.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112.CVE-2025-67187 · Other software · Totolink · reported by MITRECritical 9.8
A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules interface of /lib/cste_modules/firewall.so where the comment parameter is not properly validated for length.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so.CVE-2025-67186 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so. The vulnerability occurs because the `url` parameter is not properly validated for length, allowing remote attackers to trigger a buffer overflow, potentially leading to arbitrary code execution or denial of service.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issCVE-2026-1723 · Other software · TOTOLINK · reported by psirt@paloaltonetworks.comCritical 9.2
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection.This issue affects X6000R: through V9.4.0cu.1498_B20250826.
- Product
- X6000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Jan 30, 2026A security flaw has been discovered in Totolink A3600R 5.9c.4959.CVE-2026-1686 · Other software · Totolink · reported by VulDBHigh 7.4
A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig in the library /lib/cste_modules/app.so. Performing a manipulation of the argument apcliSsid results in buffer overflow. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
- Product
- A3600R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A weakness has been identified in Totolink A7000R 4.1cu.4154.CVE-2026-1623 · Other software · Totolink · reported by VulDBLow 2.1
A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- A7000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2026A weakness has been identified in Totolink A7000R 4.1cu.4154.CVE-2026-1601 · Other software · Totolink · reported by VulDBLow 2.1
A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument FileName can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- A7000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026A flaw has been found in Totolink A7000R 4.1cu.4154.CVE-2026-1548 · Other software · Totolink · reported by VulDBLow 2.1
A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url causes command injection. The attack can be initiated remotely. The exploit has been published and may be used.
- Product
- A7000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026A vulnerability was detected in Totolink A7000R 4.1cu.4154.CVE-2026-1547 · Other software · Totolink · reported by VulDBLow 2.1
A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
- Product
- A7000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2026A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910.CVE-2026-1328 · Other software · Totolink · reported by VulDBHigh 7.4
A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. Impacted is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 22, 2026A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910.CVE-2026-1327 · Other software · Totolink · reported by VulDBLow 2.1
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 22, 2026A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910.CVE-2026-1326 · Other software · Totolink · reported by VulDBLow 2.1
A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. This vulnerability affects the function setWanCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. This manipulation of the argument Hostname causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- NR1800X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 19, 2026A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309.CVE-2026-1158 · Other software · Totolink · reported by VulDBHigh 7.4
A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Performing a manipulation of the argument ssid results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
- Product
- LR350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 19, 2026A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309.CVE-2026-1157 · Other software · Totolink · reported by VulDBHigh 7.4
A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument ssid leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
- Product
- LR350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 19, 2026A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309.CVE-2026-1156 · Other software · Totolink · reported by VulDBHigh 7.4
A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ssid causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- LR350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 19, 2026A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309.CVE-2026-1155 · Other software · Totolink · reported by VulDBHigh 7.4
A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack may be performed from remote. The exploit has been made public and could be used.
- Product
- LR350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 19, 2026A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309.CVE-2026-1150 · Other software · Totolink · reported by VulDBLow 2.1
A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument command results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- LR350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 19, 2026A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309.CVE-2026-1149 · Other software · Totolink · reported by VulDBLow 2.1
A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
- Product
- LR350
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 19, 2026A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513.CVE-2026-1143 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A weakness has been identified in TOTOLINK A3700R 9.1.2u.5822_B20200513. This affects the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- A3700R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlavender-bicycle-a5a.notion.sitevuldb.com
Jan 8, 2026A vulnerability has been found in TOTOLINK WA1200 5.9c.2914.CVE-2026-0731 · Other software · TOTOLINK · reported by VulDBMedium 5.5
A vulnerability has been found in TOTOLINK WA1200 5.9c.2914. The impacted element is an unknown function of the file cstecgi.cgi of the component HTTP Request Handler. The manipulation leads to null pointer dereference. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
- Product
- WA1200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2026A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227.CVE-2026-0641 · Other software · TOTOLINK · reported by VulDBLow 2.1
A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the file cstecgi.cgi. The manipulation of the argument UPLOAD_FILENAME leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
- Product
- WA300
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521.CVE-2025-14964 · Other software · TOTOLINK · reported by VulDBCritical 9.3
A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to stack-based buffer overflow. The attack may be performed from remote.
- Product
- T10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control.CVE-2025-55895 · Other software · Totolink · reported by MITRECritical 9.1
TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without logging in (remote).
- Product
- A3300r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Dec 15, 2025TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter.CVE-2025-55901 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter.
- Product
- A3300r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Dec 15, 2025TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName.CVE-2025-55893 · Other software · Totolink · reported by MITREMedium 6.5
TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName.
- Product
- N200re Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Dec 13, 2025A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224.CVE-2025-14586 · Other software · TOTOLINK · reported by VulDBLow 2.1
A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089_B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- X5000R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability CVE-2025-34319 · Other software · TOTOLINK · reported by VulnCheckCritical 9.3
TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc handling functionality. An unauthenticated attacker can send specially crafted requests to trigger command execution via the targetAPSsid request parameter.
- Product
- N300RT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtotolink.twtotolink.net
Nov 13, 2025A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary.CVE-2025-60702 · Other software · Totolink · reported by MITREMedium 6.5
A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin` parameter from user input via `websGetVar` and concatenates it directly into a `ping` system command executed via `CsteSystem()` without any sanitization. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device through specially crafted HTTP requests to the router's web interface.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary.CVE-2025-60699 · Other software · Totolink · reported by MITREMedium 6.5
A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` function retrieves the `http_host` parameter from user input via `websGetVar` and copies it into a fixed-size stack buffer (`v13`) using `strcpy()` without performing any length checks. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request to the router's web interface, potentially leading to arbitrary code execution.
- Product
- A950rg Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2025A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cCVE-2025-60688 · Other software · Totolink · reported by MITREMedium 6.5
A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (setDefResponse function). The binary reads the "IpAddress" parameter from a web request and copies it into a fixed-size stack buffer using strcpy() without any length validation. Maliciously crafted input can overflow the buffer, leading to potential arbitrary code execution or memory corruption, without requiring authentication.
- Product
- Lr1200gb Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 13, 2025An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41ECVE-2025-60687 · Other software · Totolink · reported by MITREMedium 6.5
An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619_B20230130 within the cstecgi.cgi binary (sub_41EC68 function). The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long. The parameter is then directly inserted into a system command using sprintf() and executed with system(). Maliciously crafted IMEI input can execute arbitrary commands on the router without authentication.
- Product
- Lr1200gb Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 13, 2025A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GCVE-2025-60686 · Other software · Totolink · reported by MITREMedium 5.1
A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X V9.1.0u.6681_B20230703). Both programs parse the contents of /proc/net/arp using sscanf() with "%s" format specifiers into fixed-size stack buffers without length validation. Specifically, one function writes user-controlled data into a single-byte buffer, and the other into adjacent small arrays without bounds checking. An attacker who controls the contents of /proc/net/arp can trigger memory corruption, leading to denial of service or potential arbitrary code execution.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 13, 2025A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function).CVE-2025-60685 · Other software · Totolink · reported by MITREMedium 5.1
A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and subsequently parses the line using sscanf() into a single-byte variable with the %s format specifier. Maliciously crafted /proc/stat content can overwrite adjacent stack memory, potentially allowing an attacker with filesystem write privileges to execute arbitrary code on the device.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 13, 2025A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cCVE-2025-60684 · Other software · Totolink · reported by MITREMedium 6.5
A stack buffer overflow vulnerability exists in the ToToLink LR1200GB (V9.1.0u.6619_B20230130) and NR1800X (V9.1.0u.6681_B20230703) Router firmware within the cstecgi.cgi binary (sub_42F32C function). The web interface reads the "lang" parameter and constructs Help URL strings using sprintf() into fixed-size stack buffers without proper length validation. Maliciously crafted input can overflow these buffers, potentially leading to arbitrary code execution or memory corruption, without requiring authentication.
- Product
- Lr1200gb Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 13, 2025A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4 CVE-2025-60683 · Other software · Totolink · reported by MITREMedium 6.5
A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4 function that handles network interface reinitialization from '/var/system/linux_vlan_reinit'. Input is only partially validated by checking the prefix of interface names, and is concatenated into shell commands executed via system() without escaping. An attacker with write access to this file can execute arbitrary commands on the device.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 13, 2025A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sCVE-2025-60682 · Other software · Totolink · reported by MITREMedium 6.5
A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sub_402414 function that handles cloud update parameters. User-supplied 'magicid' and 'url' values are directly concatenated into shell commands and executed via system() without any sanitization or escaping. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary commands on the device.
- Product
- A720r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtotolink.net
Nov 10, 2025TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function.CVE-2025-63154 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function.CVE-2025-63153 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function.CVE-2025-63459 · Other software · Totolink · reported by MITREHigh 7.5
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function.CVE-2025-63465 · Other software · Totolink · reported by MITREHigh 7.5
Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- Lr350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_42396C function.CVE-2025-63464 · Other software · Totolink · reported by MITREHigh 7.5
Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_42396C function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- Lr350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function.CVE-2025-63463 · Other software · Totolink · reported by MITREHigh 7.5
Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- Lr350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function.CVE-2025-63462 · Other software · Totolink · reported by MITREHigh 7.5
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function.CVE-2025-63461 · Other software · Totolink · reported by MITREHigh 7.5
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function.CVE-2025-63460 · Other software · Totolink · reported by MITREHigh 7.5
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- A7000r Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2025Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_421BAC function.CVE-2025-63469 · Other software · Totolink · reported by MITREHigh 7.5
Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_421BAC function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
- Product
- Lr350 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.