Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,480

Export CSV
CVE-2026-31163

Command Injection via DHCP MTU Parameter in ToToLink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31164

Command Injection via PPPoE MTU Parameter in ToToLink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-7155

Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7152

Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-31168

Command Injection via recHour Parameter in ToToLink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31179

Command Injection through STUN Port Parameter in TOTOLINK A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31181

Remote Command Execution via STUN Server Address Injection in Totolink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31171

URL Parameter Command Injection in Totolink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the url parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31172

Command Injection in ToToLink A3300R Firmware Enabling Remote Command Execution

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31174

Command Injection via informEnable in Totolink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31176

Stun User Parameter Command Injection in ToToLink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun_user parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-7154

Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7243

Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7156

Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7244

Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7153

Totolink A8000RU CGI cstecgi.cgi setMiniuiHomeInfoShow os command injection

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setMiniuiHomeInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument sys_info results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7204

Totolink A8000RU CGI cstecgi.cgi setPptpServerCfg os command injection

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument enable causes os command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7242

Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function setOpenVpnClientCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument enabled can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 9.3 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-31166

Command Injection via Hour Parameter in Totolink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware
CVE-2026-31167

Command Injection via mode Parameter in ToToLink A3300R Firmware

An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Totolink
Products
A3300r A3300r Firmware