Totolink
Totolink N600r Firmware: vulnerabilidades y CVE
Totolink N600r Firmware tiene 38 vulnerabilidades publicadas, 5 de ellas en los últimos 12 meses. 27 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE38
Últimos 12 meses5
Críticas27
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-60336 | Alta (7.5) | 1.8% | — | 22 oct 2025 | A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
| CVE-2025-60335 | Alta (7.5) | 2.1% | — | 22 oct 2025 | A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request. |
| CVE-2025-60334 | Alta (7.5) | 0.59% | — | 22 oct 2025 | TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a… |
| CVE-2025-60333 | Alta (7.5) | 0.49% | — | 22 oct 2025 | TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial of Service (DoS)… |
| CVE-2025-11444 | Alta (7.4) | 1.0% | — | 8 oct 2025 | A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such… |
| CVE-2025-57623 | Media (5.3) | 0.39% | — | 25 sept 2025 | A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service. |
| CVE-2025-9935 | Media (5.5) | 3.0% | — | 4 sept 2025 | A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command… |
| CVE-2025-51390 | Crítica (9.8) | 1.8% | — | 4 ago 2025 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function. |
| CVE-2025-8181 | Alta (8.6) | 0.95% | — | 26 jul 2025 | A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation leads to least… |
| CVE-2025-46060 | Crítica (9.8) | 0.97% | — | 13 jun 2025 | Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component |
| CVE-2025-4496 | Alta (8.7) | 1.2% | — | 10 may 2025 | A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the… |
| CVE-2025-22903 | Media (4.6) | 0.22% | — | 15 abr 2025 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig. |
| CVE-2025-22900 | Crítica (9.8) | 0.55% | — | 15 abr 2025 | Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function. |
| CVE-2023-43141 | Crítica (9.8) | 0.79% | — | 25 sept 2023 | TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control. |
| CVE-2022-36613 | Alta (7.8) | 0.30% | — | 29 ago 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample. |
| CVE-2022-29399 | Crítica (9.8) | 1.8% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN_00415bf0. |
| CVE-2022-29398 | Crítica (9.8) | 1.8% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the File parameter in the function FUN_0041309c. |
| CVE-2022-29397 | Crítica (9.8) | 1.7% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_004196c8. |
| CVE-2022-29396 | Crítica (9.8) | 1.7% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_00418f10. |
| CVE-2022-29395 | Crítica (9.8) | 1.7% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the apcliKey parameter in the function FUN_0041bac4. |
| CVE-2022-29394 | Crítica (9.8) | 1.7% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macAddress parameter in the function FUN_0041b448. |
| CVE-2022-29393 | Crítica (9.8) | 1.7% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_004192cc. |
| CVE-2022-29392 | Crítica (9.8) | 1.7% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_00418c24. |
| CVE-2022-29391 | Crítica (9.8) | 1.7% | — | 10 may 2022 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the comment parameter in the function FUN_004200c8. |
| CVE-2022-28913 | Crítica (9.8) | 2.5% | — | 10 may 2022 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting. |
| CVE-2022-28912 | Crítica (9.8) | 2.5% | — | 10 may 2022 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW. |
| CVE-2022-28911 | Crítica (9.8) | 2.5% | — | 10 may 2022 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate. |
| CVE-2022-28910 | Crítica (9.8) | 2.5% | — | 10 may 2022 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName. |
| CVE-2022-28909 | Crítica (9.8) | 2.5% | — | 10 may 2022 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx. |
| CVE-2022-28908 | Crítica (9.8) | 2.5% | — | 10 may 2022 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.