TOTOLINK T10

TOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentials

TOTOLINK T10 cstecgi.cgi sprintf stack-based overflow

TOTOLINK T10 formLoginAuth.htm improper authentication

A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow

In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use of the compromised server as a pivot point for internal network attacks.

TOTOLINK T10 POST Request cstecgi.cgi setWiFiRepeaterCfg buffer overflow

TOTOLINK T10 POST Request cstecgi.cgi setWiFiAclRules buffer overflow

TOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflow

TOTOLINK T10 POST Request cstecgi.cgi UploadCustomModule buffer overflow

TOTOLINK T10 POST Request cstecgi.cgi setUpgradeFW buffer overflow

TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setParentalRules buffer overflow

TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setStaticDhcpRules buffer overflow

TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setIpPortFilterRules buffer overflow

TOTOLINK T10 HTTP POST Request cstecgi.cgi setWizardCfg buffer overflow

TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflow

TOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injection

TOTOLINK T10 shadow.sample hard-coded password