VendorsTOTOLINKa7000r_firmwareall versions
Vulnerabilities

TOTOLINK A7000R Firmware 9.1.0u.6115 B20201022

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

35CVEs
CVE-2022-27005
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Published 2022-03-15 · Modified
9.8EPSS 0.055
CVE-2022-27003
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Published 2022-03-15 · Modified
9.8EPSS 0.029
CVE-2022-27004
Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4 parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
Published 2022-03-15 · Modified
9.8EPSS 0.029
CVE-2026-1547
Totolink A7000R cstecgi.cgi setUnloadUserData command injection
Published 2026-01-28 · Analyzed
9.8EPSS 0.029
CVE-2024-28639
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the IP field.
Published 2024-03-16 · Modified
9.8EPSS 0.012
CVE-2022-32993
TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.
Published 2022-08-29 · Modified
9.8EPSS 0.009
CVE-2023-49418
TOTOLink A7000R V9.1.0u.6115_B20201022has a stack overflow vulnerability via setIpPortFilterRules.
Published 2023-12-11 · Modified
9.8EPSS 0.009
CVE-2023-49417
TOTOLink A7000R V9.1.0u.6115_B20201022 has a stack overflow vulnerability via setOpModeCfg.
Published 2023-12-11 · Modified
9.8EPSS 0.009
CVE-2023-36950
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
Published 2023-10-16 · Modified
9.8EPSS 0.008
CVE-2023-36947
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
Published 2023-10-16 · Modified
9.8EPSS 0.008
CVE-2023-45984
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
Published 2023-10-16 · Modified
9.8EPSS 0.007
CVE-2025-51452
In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
Published 2025-08-13 · Modified
9.8EPSS 0.004
CVE-2024-7213
TOTOLINK A7000R cstecgi.cgi setWizardCfg buffer overflow
Published 2024-07-30 · Modified
9.0EPSS 0.011
CVE-2024-7212
TOTOLINK A7000R cstecgi.cgi loginauth buffer overflow
Published 2024-07-30 · Modified
9.0EPSS 0.010
CVE-2026-1548
Totolink A7000R cstecgi.cgi CloudACMunualUpdateUserdata command injection
Published 2026-01-28 · Analyzed
8.8EPSS 0.033
CVE-2022-37079
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
Published 2022-08-25 · Modified
7.8EPSS 0.012
CVE-2022-37081
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the command parameter at setting/setTracerouteCfg.
Published 2022-08-25 · Modified
7.8EPSS 0.010
CVE-2022-37076
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
Published 2022-08-25 · Modified
7.8EPSS 0.010
CVE-2022-37082
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the host_time parameter at the function NTPSyncWithHost.
Published 2022-08-25 · Modified
7.8EPSS 0.010
CVE-2022-37083
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the ip parameter at the function setDiagnosisCfg.
Published 2022-08-25 · Modified
7.8EPSS 0.010
CVE-2022-37078
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the lang parameter at /setting/setLanguageCfg.
Published 2022-08-25 · Modified
7.8EPSS 0.009
CVE-2022-37080
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the command parameter at setting/setTracerouteCfg.
Published 2022-08-25 · Modified
7.8EPSS 0.003
CVE-2022-37084
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the sPort parameter at the addEffect function.
Published 2022-08-25 · Modified
7.8EPSS 0.003
CVE-2022-37075
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ip parameter in the function setDiagnosisCfg.
Published 2022-08-25 · Modified
7.8EPSS 0.003
CVE-2022-37077
TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the pppoeUser parameter.
Published 2022-08-25 · Modified
7.8EPSS 0.003
CVE-2024-28640
Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the command field.
Published 2024-03-16 · Analyzed
7.5EPSS 0.142
CVE-2023-45985
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Published 2023-10-16 · Modified
7.5EPSS 0.007
CVE-2025-63459
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Published 2025-10-31 · Analyzed
7.5EPSS 0.004
CVE-2025-63460
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Published 2025-10-31 · Analyzed
7.5EPSS 0.004
CVE-2025-63461
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Published 2025-10-31 · Analyzed
7.5EPSS 0.004
CVE-2025-63462
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Published 2025-10-31 · Analyzed
7.5EPSS 0.004
CVE-2025-63153
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Published 2025-11-10 · Analyzed
7.5EPSS 0.004
CVE-2025-63154
TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Published 2025-11-10 · Analyzed
7.5EPSS 0.004
CVE-2026-1623
Totolink A7000R cstecgi.cgi setUpgradeFW command injection
Published 2026-01-29 · Analyzed
6.5EPSS 0.023
CVE-2026-1601
Totolink A7000R cstecgi.cgi setUploadUserData command injection
Published 2026-01-29 · Analyzed
6.5EPSS 0.020