TOTOLINK EX1200T Firmware 4.1.2cu.5230 B20210706

TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.

TOTOLINK EX1200T cstecgi.cgi setLanguageCfg stack-based overflow

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to attack.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to attack.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime to attack.

TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via the "main" function.

TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileName parameter.

TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWlanIdx parameter.

In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

TOTOLINK EX1200T HTTP POST Request formFilter buffer overflow

TOTOLINK EX1200T HTTP POST Request formWlanRedirect buffer overflow

TOTOLINK EX1200T HTTP POST Request formReflashClientTbl buffer overflow

TOTOLINK EX1200T HTTP POST Request formWirelessTbl buffer overflow

TOTOLINK EX1200T HTTP POST Request formWsc buffer overflow

TOTOLINK EX1200T HTTP POST Request formDMZ buffer overflow

TOTOLINK A702R/A3002R/A3002RU/EX1200T HTTP POST Request formIPv6Addr buffer overflow

TOTOLINK EX1200T HTTP POST Request formIpQoS buffer overflow

TOTOLINK EX1200T HTTP POST Request formSysCmd buffer overflow

TOTOLINK EX1200T HTTP POST Request formSysLog buffer overflow

TOTOLINK EX1200T HTTP POST Request formMultiAP buffer overflow

TOTOLINK EX1200T HTTP POST Request formStats buffer overflow

TOTOLINK EX1200T HTTP POST Request formNtp buffer overflow

TOTOLINK EX1200T cstecgi.cgi setStaticDhcpConfig stack-based overflow

TOTOLINK EX1200T HTTP POST Request formIpv6Setup buffer overflow

TOTOLINK EX1200T HTTP POST Request formSaveConfig buffer overflow

TOTOLINK EX1200T HTTP POST Request formTmultiAP buffer overflow

TOTOLINK EX1200T HTTP POST Request formPortFw buffer overflow

totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.

TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.

TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file.

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization through getSysStatusCfg.

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, etc.) without authorization.

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can obtain sensitive information (wifikey, wifiname, etc.) without authorization.

In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware.