TOTOLINK vulnerabilities

CVEs per yearBy the year they were published

1. 2024100
2. 202418
3. 2025191
4. 2026235

Newest CVEs

• CVE-2026-116508

  TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow

  TOTOLINK · A950RG

  Critical10.0
• CVE-2026-116507

  TOTOLINK A950RG global.so getLanguageCfg information disclosure

  TOTOLINK · A950RG

  Medium6.9
• CVE-2026-116506

  TOTOLINK A950RG firewall.so apmib_set command injection

  TOTOLINK · A950RG

  Critical9.4
• CVE-2026-116505

  TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection

  TOTOLINK · A950RG

  Critical9.4
• CVE-2026-116504

  TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection

  TOTOLINK · A950RG

  Critical9.4
• CVE-2026-114575

  TOTOLINK A950RG product.so UploadCustomModule command injection

  TOTOLINK · A950RG

  Critical10.0
• CVE-2026-114383

  TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow

  TOTOLINK · EX200

  Critical10.0
• CVE-2026-114382

  TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow

  TOTOLINK · EX200

  Critical10.0
• CVE-2026-35499

  An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A…

  totolink · Totolink

  Critical9.1
• CVE-2026-40627

  An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A…

  totolink · Totolink

  Critical9.1