en
Totolink is a global networking hardware vendor known for affordable routers and related firmware. It operates in the consumer and SMB segments with a global reach, and provides firmware updates and security advisories tied to its product lines.
Severity across 160 analyzed records
The GCVE catalog currently lists 490 vulnerability records associated with TOTOLINK.
Among the 160 records analyzed by CyStack, 110 are High or Critical and 0 appear in the CISA KEV catalog for priority remediation.
Totolink is a multinational networking equipment vendor that designs and markets consumer and business routers, access points, and related firmware. The company focuses on affordable, feature-rich networking gear sold in multiple regions and supports ongoing firmware updates and security advisories. Totolink maintains an official site with product information and user guides across global markets.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-85031TOTOLINK CP450 cstecgi.cgi buffer overflow | Exploitation statusNot known exploited | FixNot confirmed | Affected productCP450 | Published09/03/2026 | SeverityCritical |
CVE-2026-82616TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published08/31/2026 | SeverityCritical |
CVE-2026-82597TOTOLINK NR1800X cstecgi.cgi setUssd command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published08/31/2026 | SeverityMedium |
CVE-2026-82555TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values | Exploitation statusPublic exploit | FixNot confirmed | Affected productN600R | Published08/30/2026 | SeverityMedium |
CVE-2026-82539TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption | Exploitation statusPublic exploit | FixNot confirmed | Affected productA720R | Published08/30/2026 | SeverityCritical |
CVE-2026-79912TOTOLINK N600R cstecgi.cgi getCurrentTime command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productN600R | Published08/25/2026 | SeverityMedium |
CVE-2026-79911TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN600R | Published08/25/2026 | SeverityCritical |
CVE-2026-75013TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference | Exploitation statusPublic exploit | FixNot confirmed | Affected productEX1200L | Published08/17/2026 | SeverityHigh |
CVE-2026-75012TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference | Exploitation statusPublic exploit | FixNot confirmed | Affected productEX1200L | Published08/17/2026 | SeverityHigh |
CVE-2026-19847TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19846TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19845TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19844TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19815TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19814TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19813TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19812TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19811TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-15701Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published07/14/2026 | SeverityCritical |
CVE-2026-15271TOTOLINK EX200 Web boa.conf least privilege violation | Exploitation statusNot known exploited | FixNot confirmed | Affected productA3000RU | Published07/09/2026 | SeverityHigh |
CVE-2026-15204TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal | Exploitation statusPublic exploit | FixNot confirmed | Affected productX5000R | Published07/09/2026 | SeverityMedium |
CVE-2026-44089Buffer Overflow in Totolink EX1200L router | Exploitation statusNot known exploited | FixNot confirmed | Affected productEX1200L | Published06/23/2026 | SeverityCritical |
CVE-2026-11620TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productEX200 | Published06/09/2026 | SeverityMedium |
CVE-2026-11554TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productCP450 | Published06/08/2026 | SeverityMedium |
CVE-2026-11494TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productAC1200 T8 | Published06/08/2026 | SeverityMedium |
CVE-2026-10187Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/31/2026 | SeverityCritical |
CVE-2026-9543Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/26/2026 | SeverityCritical |
CVE-2026-9534Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9533Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9532Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9531Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9515Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9514Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9513Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9512Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9511Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9478Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9477Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9476Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9475Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9458Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9457Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9456Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9455Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9454Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9436Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9435Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9434Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9433Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9432Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9408Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9407Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9406Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9405Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9404Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9388Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9387Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9386Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9385Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9384Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-8137Totolink X5000R formDdns sub_458E40 buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productX5000R | Published05/08/2026 | SeverityHigh |
CVE-2026-7823Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/05/2026 | SeverityCritical |
CVE-2026-7750Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/04/2026 | SeverityHigh |
CVE-2026-7749Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/04/2026 | SeverityHigh |
CVE-2026-7748Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow | Exploitation statusPublic exploit | FixYes | Affected productN300RH | Published05/04/2026 | SeverityHigh |
CVE-2026-7747Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/04/2026 | SeverityCritical |
CVE-2026-7721Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityMedium |
CVE-2026-7720Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityMedium |
CVE-2026-7719Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityCritical |
CVE-2026-7718Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityMedium |
CVE-2026-7717Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityHigh |
CVE-2026-7633Totolink N300RH cstecgi.cgi setUploadSetting file inclusion | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/02/2026 | SeverityMedium |
CVE-2026-7548Totolink NR1800X cstecgi.cgi sub_41A68C command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published05/01/2026 | SeverityHigh |
CVE-2026-7546Totolink NR1800X lighttpd find_host_ip stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published05/01/2026 | SeverityCritical |
CVE-2026-7538Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/01/2026 | SeverityCritical |
CVE-2026-7244Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7243Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7242Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7241Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7240Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7219Totolink N300RT formIpQoS buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RT | Published04/28/2026 | SeverityHigh |
CVE-2026-7218Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RT | Published04/28/2026 | SeverityHigh |
CVE-2026-7204Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7203Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7202Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7156Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7155Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7154Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7153Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7152Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7140Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7139Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7138Totolink A8000RU CGI cstecgi.cgi setNtpCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7137Totolink A8000RU CGI cstecgi.cgi setStorageCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7136Totolink A8000RU CGI cstecgi.cgi setDmzCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7125Totolink A8000RU CGI cstecgi.cgi setWiFiEasyCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7124Totolink A8000RU CGI cstecgi.cgi setIpv6LanCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7123Totolink A8000RU CGI cstecgi.cgi setIptvCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7122Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CVE-2026-7121Totolink A8000RU CGI cstecgi.cgi setWizardCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
