Totolink
Totolink A720r Firmware: vulnerabilidades y CVE
Totolink A720r Firmware tiene 28 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 8 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE28
Últimos 12 meses4
Críticas8
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-60686 | Media (5.1) | 0.22% | — | 13 nov 2025 | A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X… |
| CVE-2025-60685 | Media (5.1) | 0.22% | — | 13 nov 2025 | A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a local buffer and… |
| CVE-2025-60683 | Media (6.5) | 1.0% | — | 13 nov 2025 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4 function that handles network interface reinitialization… |
| CVE-2025-60682 | Media (6.5) | 1.5% | — | 13 nov 2025 | A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sub_402414 function that handles cloud update parameters.… |
| CVE-2025-9303 | Alta (7.4) | 0.85% | — | 21 ago 2025 | A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument desc results in… |
| CVE-2025-4271 | Media (6.9) | 0.66% | — | 5 may 2025 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument… |
| CVE-2025-4270 | Media (6.9) | 14% | — | 5 may 2025 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the… |
| CVE-2025-4269 | Media (6.9) | 0.59% | — | 5 may 2025 | A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the… |
| CVE-2025-4268 | Media (6.9) | 1.1% | — | 5 may 2025 | A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input… |
| CVE-2024-8869 | Baja (2.3) | 1.7% | — | 15 sept 2024 | A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command injection. It is possible to launch the attack remotely. The… |
| CVE-2023-23064 | Crítica (9.8) | 0.70% | — | 17 feb 2023 | TOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control. |
| CVE-2022-38535 | Alta (7.2) | 2.1% | — | 15 sept 2022 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function. |
| CVE-2022-38534 | Alta (7.2) | 2.1% | — | 15 sept 2022 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function. |
| CVE-2022-36610 | Alta (7.8) | 0.30% | — | 29 ago 2022 | TOTOLINK A720R V4.1.5cu.532_B20210610 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
| CVE-2022-36456 | Alta (7.8) | 1.0% | — | 25 ago 2022 | TOTOLink A720R V4.1.5cu.532_B20210610 was discovered to contain a command injection vulnerability via the username parameter in /cstecgi.cgi. |
| CVE-2021-43662 | Media (6.5) | 0.55% | — | 31 mar 2022 | totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption. |
| CVE-2021-45742 | Crítica (9.8) | 3.1% | — | 4 feb 2022 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter. |
| CVE-2021-45740 | Crítica (9.8) | 1.4% | — | 4 feb 2022 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the pin parameter. |
| CVE-2021-45739 | Alta (7.5) | 1.2% | — | 4 feb 2022 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the flag parameter. |
| CVE-2021-45737 | Alta (7.5) | 1.2% | — | 4 feb 2022 | TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the Form_Login function. This vulnerability allows attackers to cause a Denial of Service (DoS) via the Host parameter. |
| CVE-2021-44247 | Crítica (9.8) | 2.8% | — | 4 feb 2022 | Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability… |
| CVE-2021-44246 | Alta (7.5) | 1.2% | — | 4 feb 2022 | Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain a stack overflow in the function setNoticeCfg. This vulnerability allows attackers… |
| CVE-2021-35327 | Crítica (9.8) | 1.4% | — | 5 ago 2021 | A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default credentials via a crafted POST request. |
| CVE-2021-35326 | Alta (7.5) | 2.5% | — | 5 ago 2021 | A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request. |
| CVE-2021-35325 | Alta (7.5) | 13% | — | 5 ago 2021 | A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS). |
| CVE-2021-35324 | Crítica (9.8) | 10% | — | 5 ago 2021 | A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication. |
| CVE-2021-27710 | Crítica (9.8) | 7.9% | — | 14 abr 2021 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a… |
| CVE-2021-27708 | Crítica (9.8) | 7.6% | — | 14 abr 2021 | Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.