en
Totolink is a global networking equipment vendor that designs and sells consumer and small‑business devices such as wireless routers, access points, switches, and related PoE products. It operates through regional offices and partners worldwide, offering products intended for homes, small offices, and enterprise‑lite deployments. Totolink maintains an online presence with product lines and support resources across multiple markets.
As of 11/08/2026, TOTOLINK recorded 85 security vulnerabilities in the last 90 days across 14 products, including 78 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Totolink had the most security vulnerabilities in the TOTOLINK ecosystem, with 30 vulnerabilities—approximately 35.29% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-10131CVE-2026-10131CVE-2026-105484TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injectionCVE-2026-105286Totolink A3002MU File Upload formUploadFile sub_44B250 path traversalCVE-2026-105285Totolink A3002MU QoS Rule formIpQoS stack-based overflowCVE-2026-105284Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-10131CVE-2026-10131 | Exploitation statusNot confirmed | FixNo | Affected product |
| Published10/20/2026 |
| SeverityCritical |
CVE-2026-105484TOTOLINK X6000R UploadFirmwareFile cstecgi.cgi firmware_check os command injection | Exploitation statusNot exploited | FixNo | Affected productX6000R | Published10/06/2026 | SeverityCritical |
|---|
CVE-2026-105286Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-105285Totolink A3002MU QoS Rule formIpQoS stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published10/05/2026 | SeverityCritical |
|---|
CVE-2026-105284Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published10/05/2026 | SeverityCritical |
|---|
CVE-2026-100896TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection | Exploitation statusActively exploited | FixNo | Affected productN150RT | Published09/28/2026 | SeverityCritical |
|---|
CVE-2026-93742Totolink A3002MU formWsc command injection | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/19/2026 | SeverityCritical |
|---|
CVE-2026-93741Totolink A3002MU formWlWds buffer overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/19/2026 | SeverityCritical |
|---|
CVE-2026-93740Totolink A3002MU formWlEncrypt buffer overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/18/2026 | SeverityCritical |
|---|
CVE-2026-93739Totolink A3002MU formWlAc buffer overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/18/2026 | SeverityCritical |
|---|
CVE-2026-93738Totolink A3002MU formSchedule buffer overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/18/2026 | SeverityCritical |
|---|
CVE-2026-91853TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection | Exploitation statusActively exploited | FixNo | Affected productX5000R | Published09/15/2026 | SeverityMedium |
|---|
CVE-2026-90608Totolink A3002MU boa formPortFw buffer overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/14/2026 | SeverityCritical |
|---|
CVE-2026-90607Totolink A3002MU boa formNewSchedule buffer overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/14/2026 | SeverityCritical |
|---|
CVE-2026-90606Remote Buffer Overflow in the Totolink A3002MU Management Interface | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/13/2026 | SeverityCritical |
|---|
CVE-2026-90605Totolink A3002MU boa formFilter buffer overflow | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/13/2026 | SeverityCritical |
|---|
CVE-2026-90604Totolink A3002MU Anchor Tag cross site scripting | Exploitation statusActively exploited | FixNo | Affected productA3002MU | Published09/13/2026 | SeverityMedium |
|---|
CVE-2026-85031TOTOLINK CP450 cstecgi.cgi buffer overflow | Exploitation statusNot exploited | FixNo | Affected productCP450 | Published09/03/2026 | SeverityCritical |
|---|
CVE-2026-82616TOTOLINK NR1800X cstecgi.cgi setUploadSetting stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productNR1800X | Published08/31/2026 | SeverityCritical |
|---|
CVE-2026-82597TOTOLINK NR1800X cstecgi.cgi setUssd command injection | Exploitation statusActively exploited | FixNo | Affected productNR1800X | Published08/31/2026 | SeverityMedium |
|---|
CVE-2026-82555TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values | Exploitation statusActively exploited | FixNo | Affected productN600R | Published08/30/2026 | SeverityMedium |
|---|
CVE-2026-82539TOTOLINK A720R MAC Filtering cstecgi.cgi setMacFilterRules memory corruption | Exploitation statusActively exploited | FixNo | Affected productA720R | Published08/30/2026 | SeverityCritical |
|---|
CVE-2026-79912TOTOLINK N600R cstecgi.cgi getCurrentTime command injection | Exploitation statusActively exploited | FixNo | Affected productN600R | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-79911TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productN600R | Published08/25/2026 | SeverityCritical |
|---|
CVE-2026-75013TOTOLINK EX1200L cstecgi.cgi setWizardCfg null pointer dereference | Exploitation statusActively exploited | FixNo | Affected productEX1200L | Published08/17/2026 | SeverityHigh |
|---|
CVE-2026-75012TOTOLINK EX1200L Password Configuration cstecgi.cgi setPasswordCfg null pointer dereference | Exploitation statusActively exploited | FixNo | Affected productEX1200L | Published08/17/2026 | SeverityHigh |
|---|
CVE-2026-19847TOTOLINK A800R wps.so cstecgi.cgi setWiFiWpsConfig stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19846TOTOLINK A800R firewall.so cstecgi.cgi setUrlFilterRules stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19845TOTOLINK A800R lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19844TOTOLINK A800R ipv6.so cstecgi.cgi setRadvdCfg stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19815TOTOLINK A800R firewall.so cstecgi.cgi setParentalRules stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19814TOTOLINK A800R firewall.so cstecgi.cgi setMacQos stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19813TOTOLINK A800R firewall.so cstecgi.cgi setMacFilterRules stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19812TOTOLINK A800R product.so cstecgi.cgi UploadCustomModule stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-19811TOTOLINK A800R firewall.so cstecgi.cgi setIpQosRules stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productA800R | Published08/14/2026 | SeverityHigh |
|---|
CVE-2026-15701Totolink NR1800X lighttpd formLogout.htm Form_Logout stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productNR1800X | Published07/14/2026 | SeverityCritical |
|---|
CVE-2026-15271TOTOLINK EX200 Web boa.conf least privilege violation | Exploitation statusNot exploited | FixNo | Affected productA3000RU | Published07/09/2026 | SeverityHigh |
|---|
CVE-2026-15204TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal | Exploitation statusActively exploited | FixNo | Affected productX5000R | Published07/09/2026 | SeverityMedium |
|---|
CVE-2026-44089Buffer Overflow in Totolink EX1200L router | Exploitation statusNot exploited | FixNo | Affected productEX1200L | Published06/23/2026 | SeverityCritical |
|---|
CVE-2026-11620TOTOLINK EX200 vsftpd vsftpd.conf least privilege violation | Exploitation statusActively exploited | FixNo | Affected productEX200 | Published06/09/2026 | SeverityMedium |
|---|
CVE-2026-11554TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation | Exploitation statusActively exploited | FixNo | Affected productCP450 | Published06/08/2026 | SeverityMedium |
|---|
CVE-2026-11494TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation | Exploitation statusActively exploited | FixNo | Affected productAC1200 T8 | Published06/08/2026 | SeverityMedium |
|---|
CVE-2026-10187Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow | Exploitation statusActively exploited | FixNo | Affected productN300RH | Published05/31/2026 | SeverityCritical |
|---|
CVE-2026-9543Totolink N300RH Web Management cstecgi.cgi setPasswordCfg os command injection | Exploitation statusActively exploited | FixNo | Affected productN300RH | Published05/26/2026 | SeverityCritical |
|---|
CVE-2026-9534Totolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injection | Exploitation statusActively exploited | FixNo | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-9533Totolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injection | Exploitation statusActively exploited | FixNo | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-9532Totolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injection | Exploitation statusActively exploited | FixNo | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-9531Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection | Exploitation statusActively exploited | FixNo | Affected productCA750-PoE | Published05/26/2026 | SeverityMedium |
|---|
CVE-2026-9515Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injection | Exploitation statusActively exploited | FixNo | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
|---|
CVE-2026-9514Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injection | Exploitation statusActively exploited | FixNo | Affected productCA750-PoE | Published05/25/2026 | SeverityMedium |
|---|
296 Results | Page 2 of 6