- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/05/2026, Totolink recorded 36 security vulnerabilities in the last 90 days across 15 products, including 29 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, A3002MU had the most security vulnerabilities in the Totolink ecosystem, with 13 vulnerabilities—approximately 36.11% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-105286Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published10/05/2026 | SeverityMedium |
CVE-2026-105285Totolink A3002MU QoS Rule formIpQoS stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published10/05/2026 | SeverityCritical |
CVE-2026-105284Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published10/05/2026 | SeverityCritical |
CVE-2026-100896TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productN150RT | Published09/28/2026 | SeverityCritical |
CVE-2026-93742Totolink A3002MU formWsc command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/19/2026 | SeverityCritical |
CVE-2026-93741Totolink A3002MU formWlWds buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/19/2026 | SeverityCritical |
CVE-2026-93740Totolink A3002MU formWlEncrypt buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/18/2026 | SeverityCritical |
CVE-2026-93739Totolink A3002MU formWlAc buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/18/2026 | SeverityCritical |
CVE-2026-93738Totolink A3002MU formSchedule buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/18/2026 | SeverityCritical |
CVE-2026-91853TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productX5000R | Published09/15/2026 | SeverityMedium |
CVE-2026-90608Totolink A3002MU boa formPortFw buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/14/2026 | SeverityCritical |
CVE-2026-90607Totolink A3002MU boa formNewSchedule buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/14/2026 | SeverityCritical |
CVE-2026-90606Totolink A3002MU boa formIpv6Setup buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/13/2026 | SeverityCritical |
CVE-2026-90605Totolink A3002MU boa formFilter buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/13/2026 | SeverityCritical |
CVE-2026-90604Totolink A3002MU Anchor Tag cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Affected productA3002MU | Published09/13/2026 | SeverityMedium |
CVE-2026-85031TOTOLINK CP450 cstecgi.cgi buffer overflow | Exploitation statusNot known exploited | FixNot confirmed | Affected productCP450 | Published09/03/2026 | SeverityCritical |
CVE-2026-82616TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published08/31/2026 | SeverityCritical |
CVE-2026-82597TOTOLINK NR1800X cstecgi.cgi setUssd command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published08/31/2026 | SeverityMedium |
CVE-2026-82555TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values | Exploitation statusPublic exploit | FixNot confirmed | Affected productN600R | Published08/30/2026 | SeverityMedium |
CVE-2026-82539TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption | Exploitation statusPublic exploit | FixNot confirmed | Affected productA720R | Published08/30/2026 | SeverityCritical |
CVE-2026-79912TOTOLINK N600R cstecgi.cgi getCurrentTime command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productN600R | Published08/25/2026 | SeverityMedium |
CVE-2026-79911TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN600R | Published08/25/2026 | SeverityCritical |
CVE-2026-75013TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference | Exploitation statusPublic exploit | FixNot confirmed | Affected productEX1200L | Published08/17/2026 | SeverityHigh |
CVE-2026-75012TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference | Exploitation statusPublic exploit | FixNot confirmed | Affected productEX1200L | Published08/17/2026 | SeverityHigh |
CVE-2026-19847TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19846TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19845TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19844TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19815TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19814TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19813TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19812TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-19811TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productA800R | Published08/14/2026 | SeverityHigh |
CVE-2026-15701Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published07/14/2026 | SeverityCritical |
CVE-2026-15271TOTOLINK EX200 Web boa.conf least privilege violation | Exploitation statusNot known exploited | FixNot confirmed | Affected productA3000RU | Published07/09/2026 | SeverityHigh |
CVE-2026-15204TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal | Exploitation statusPublic exploit | FixNot confirmed | Affected productX5000R | Published07/09/2026 | SeverityMedium |
CVE-2026-44089Buffer Overflow in Totolink EX1200L router | Exploitation statusNot known exploited | FixNot confirmed | Affected productEX1200L | Published06/23/2026 | SeverityCritical |
CVE-2026-11620TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productEX200 | Published06/09/2026 | SeverityMedium |
CVE-2026-11554TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productCP450 | Published06/08/2026 | SeverityMedium |
CVE-2026-11494TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation | Exploitation statusPublic exploit | FixNot confirmed | Affected productAC1200 T8 | Published06/08/2026 | SeverityMedium |
CVE-2026-10187Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/31/2026 | SeverityCritical |
CVE-2026-9543Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/26/2026 | SeverityCritical |
CVE-2026-9534Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9533Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9532Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9531Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
CVE-2026-9515Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9514Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9513Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9512Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9511Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
CVE-2026-9478Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9477Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9476Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9475Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9458Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9457Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9456Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9455Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9454Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9436Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9435Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9434Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9433Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9432Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9408Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/25/2026 | SeverityCritical |
CVE-2026-9407Totolink A8000RU Web Management cstecgi.cgi setFirewallType os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9406Totolink A8000RU Web Management cstecgi.cgi setRemoteCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9405Totolink A8000RU Web Management cstecgi.cgi setGameSpeedCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9404Totolink A8000RU Web Management cstecgi.cgi setDdnsCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9388Totolink A8000RU Web Management cstecgi.cgi setScheduleCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9387Totolink A8000RU Web Management cstecgi.cgi setUpgradeFW os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9386Totolink A8000RU Web Management cstecgi.cgi setLanguageCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9385Totolink A8000RU Web Management cstecgi.cgi setTracerouteCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-9384Totolink A8000RU Web Management cstecgi.cgi setDiagnosisCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/24/2026 | SeverityCritical |
CVE-2026-8137Totolink X5000R formDdns sub_458E40 buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productX5000R | Published05/08/2026 | SeverityHigh |
CVE-2026-7823Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/05/2026 | SeverityCritical |
CVE-2026-7750Totolink N300RH POST Request cstecgi.cgi setMacFilterRules buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/04/2026 | SeverityHigh |
CVE-2026-7749Totolink N300RH POST Request cstecgi.cgi setWanConfig buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/04/2026 | SeverityHigh |
CVE-2026-7748Totolink N300RH POST Request cstecgi.cgi setUpgradeFW buffer overflow | Exploitation statusPublic exploit | FixYes | Affected productN300RH | Published05/04/2026 | SeverityHigh |
CVE-2026-7747Totolink N300RH Parameter cstecgi.cgi loginauth buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/04/2026 | SeverityCritical |
CVE-2026-7721Totolink WA300 cstecgi.cgi NTPSyncWithHost command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityMedium |
CVE-2026-7720Totolink WA300 POST Request cstecgi.cgi setLanguageCfg command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityMedium |
CVE-2026-7719Totolink WA300 POST Request cstecgi.cgi loginauth buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityCritical |
CVE-2026-7718Totolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityMedium |
CVE-2026-7717Totolink WA300 POST Request cstecgi.cgi UploadCustomModule buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productWA300 | Published05/04/2026 | SeverityHigh |
CVE-2026-7633Totolink N300RH cstecgi.cgi setUploadSetting file inclusion | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RH | Published05/02/2026 | SeverityMedium |
CVE-2026-7548Totolink NR1800X cstecgi.cgi sub_41A68C command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published05/01/2026 | SeverityHigh |
CVE-2026-7546Totolink NR1800X lighttpd find_host_ip stack-based overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productNR1800X | Published05/01/2026 | SeverityCritical |
CVE-2026-7538Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published05/01/2026 | SeverityCritical |
CVE-2026-7244Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7243Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7242Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7241Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7240Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7219Totolink N300RT formIpQoS buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RT | Published04/28/2026 | SeverityHigh |
CVE-2026-7218Totolink N300RT libapmib.so formWsc is_cmd_string_valid buffer overflow | Exploitation statusPublic exploit | FixNot confirmed | Affected productN300RT | Published04/28/2026 | SeverityHigh |
CVE-2026-7204Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7203Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/28/2026 | SeverityCritical |
CVE-2026-7202Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productA8000RU | Published04/27/2026 | SeverityCritical |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan