A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument lang leads to os command injection. The attack may be performed from remote. The exploit is publicly available and might be used.
A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. This manipulation of the argument command causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument ip results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used.
CVE-2026-8137 is a high-severity buffer overflow vulnerability in the Totolink X5000R router firmware version 9.1.0u.6369_B20230113. The flaw exists in the function sub_458E40 within the /boafrm/formDdns file, where improper handling of the submit-url argument can lead to a buffer overflow condition. This vulnerability can be exploited remotely without user interaction and does not require privileges. Although the exploit code has been publicly disclosed, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance is currently available from the vendor. Users should monitor vendor advisories for updates and apply fixes once released.
CVE-2026-7823 is a critical OS command injection vulnerability in the Totolink A8000RU router firmware version 7.1cu.643_b20200521. The flaw exists in the setAppFilterCfg function within the /cgi-bin/cstecgi.cgi file, where manipulation of the 'enable' argument allows remote attackers to execute arbitrary OS commands. The vulnerability is remotely exploitable without authentication and has a high CVSS 4.0 score of 9.3. Although a public exploit is available, there is no confirmed patch or official remediation at this time.
CVE-2026-7750 is a high-severity buffer overflow vulnerability in the Totolink N300RH router firmware version 3.2.4-B20220812. The flaw exists in the setMacFilterRules function within the /cgi-bin/cstecgi.cgi POST request handler, where improper handling of the mac_address argument allows remote attackers to cause a buffer overflow. Exploits for this vulnerability are publicly available, increasing the risk of exploitation. No official patch or remediation guidance has been provided by the vendor as of the publication date.
A security vulnerability has been detected in Totolink N300RH 3.2.4-B20220812. This affects the function setWanConfig of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument priDns leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
A weakness has been identified in Totolink N300RH 3.2.4-B20220812. Affected by this issue is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. Executing a manipulation of the argument FileName can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in Totolink N300RH 3.2.4-B20220812. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument Password results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
A security vulnerability has been detected in Totolink WA300 5.2cu.7112_B20190227. This affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument hostTime leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-7720 is a command injection vulnerability in the Totolink WA300 router firmware version 5.2cu.7112_B20190227. The issue exists in the setLanguageCfg function of the /cgi-bin/cstecgi.cgi POST request handler, where manipulation of the langType argument allows remote attackers to execute arbitrary commands. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3. Although an exploit is publicly available, there are no known exploits observed in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
CVE-2026-7719 is a critical buffer overflow vulnerability in the Totolink WA300 router firmware version 5.2cu.7112_B20190227. The flaw exists in the loginauth function within the /cgi-bin/cstecgi.cgi POST request handler, where improper handling of the http_host argument can lead to a buffer overflow. This vulnerability can be exploited remotely without authentication and user interaction. Although an exploit has been publicly released, there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.
A vulnerability was identified in Totolink WA300 5.2cu.7112_B20190227. Impacted is the function setWebWlanIdx of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument webWlanIdx leads to command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2026-7717 is a high-severity buffer overflow vulnerability in the Totolink WA300 router firmware version 5.2cu.7112_B20190227. It affects the UploadCustomModule function in the /cgi-bin/cstecgi.cgi POST request handler. An attacker can remotely exploit this vulnerability by manipulating the File argument, potentially causing a buffer overflow. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used.
A vulnerability was detected in Totolink NR1800X 9.1.0u.6279_B20210910. This affects the function sub_41A68C of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument setUssd results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A security vulnerability has been detected in Totolink NR1800X 9.1.0u.6279_B20210910. The impacted element is the function find_host_ip of the component lighttpd. Such manipulation of the argument Host leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function Vulnerability of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument proto leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.