Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Sep 16, 2022TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgiCVE-2022-38828 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgiCVE-2022-38827 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.CVE-2022-38826 · Other software · Totolink · reported by MITRECritical 9.8
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.CVE-2022-38823 · Other software · Totolink · reported by MITRECritical 9.8
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c.CVE-2022-32053 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4.CVE-2022-32052 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.CVE-2022-32051 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40.CVE-2022-32050 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.CVE-2022-32049 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88.CVE-2022-32048 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4.CVE-2022-32047 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.CVE-2022-32046 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4.CVE-2022-32045 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2022TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80.CVE-2022-32044 · Other software · Totolink · reported by MITREHigh 7.5
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2022TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function.CVE-2022-25084 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_FirmwCVE-2022-25137 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Feb 18, 2022A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_FirmwareCVE-2022-25136 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Feb 18, 2022A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackersCVE-2022-25135 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Feb 18, 2022A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to exeCVE-2022-25134 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Feb 18, 2022A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers toCVE-2022-25133 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Feb 18, 2022A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to exCVE-2022-25132 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Feb 18, 2022A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 VCVE-2022-25131 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Feb 18, 2022A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware CVE-2022-25130 · Other software · Totolink · reported by MITRECritical 9.8
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.
- Product
- T6 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.