Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2704▼ 598 respecto a la semana anterior

Críticas / altas1288▼ 199 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)299▼ 211 respecto a la semana anterior

64 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2024-23061	Modificada	Crítica (9.8)	1.7%	—	Totolink A3300r Firmware	11/1/2024	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function.
CVE-2024-23060	Modificada	Crítica (9.8)	1.7%	—	Totolink A3300r Firmware	11/1/2024	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function.
CVE-2024-23059	Modificada	Crítica (9.8)	1.7%	—	Totolink A3300r Firmware	11/1/2024	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function.
CVE-2024-23058	Modificada	Crítica (9.8)	1.6%	—	Totolink A3300r Firmware	11/1/2024	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function.
CVE-2024-23057	Modificada	Crítica (9.8)	1.6%	—	Totolink A3300r Firmware	11/1/2024	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function.
CVE-2024-22942	Modificada	Crítica (9.8)	1.6%	—	Totolink A3300r Firmware	11/1/2024	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function.
CVE-2023-46993	Modificada	Crítica (9.8)	1.5%	—	Totolink A3300r Firmware	31/10/2023	17/6/2026	In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command injection.
CVE-2023-46992	Modificada	Alta (7.5)	0.54%	—	Totolink A3300r Firmware	31/10/2023	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without authentication by visiting specific pages.
CVE-2023-46976	Modificada	Crítica (9.8)	1.5%	—	Totolink A3300r Firmware	31/10/2023	17/6/2026	TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function.
CVE-2023-37173	Modificada	Crítica (9.8)	2.0%	—	Totolink A3300r Firmware	7/7/2023	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
CVE-2023-37172	Modificada	Crítica (9.8)	2.0%	—	Totolink A3300r Firmware	7/7/2023	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
CVE-2023-37171	Modificada	Crítica (9.8)	2.0%	—	Totolink A3300r Firmware	7/7/2023	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVE-2023-37170	Modificada	Crítica (9.8)	1.7%	—	Totolink A3300r Firmware	7/7/2023	17/6/2026	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
CVE-2023-31729	Modificada	Crítica (9.8)	1.3%	—	Totolink A3300r Firmware	18/5/2023	9/7/2026	TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.