CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 1CVE-2022-41525
https://notcve.org/view.php?id=CVE-2022-41525
06 Oct 2022 — TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi. Se ha detectado que TOTOLINK NR1800X versión V9.1.0u.6279_B20210910, contiene una vulnerabilidad de inyección de comandos por medio de la función OpModeCfg en el archivo /cgi-bin/cstecgi.cgi • https://brief-nymphea-813.notion.site/NR1800X-command-injection-setOpModeCfg-7b10868ba53544148d9aa3100b5df5cc • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-41526
https://notcve.org/view.php?id=CVE-2022-41526
06 Oct 2022 — TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function. Se ha detectado que TOTOLINK NR1800X versión V9.1.0u.6279_B20210910, contiene un desbordamiento de pila autenticado por medio del parámetro ip en la función setDiagnosisCfg • https://brief-nymphea-813.notion.site/NR1800X-bof-setDiagnosisCfg-fcbc55a98e4b4bfbb94db610e666e834 • CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-41527
https://notcve.org/view.php?id=CVE-2022-41527
06 Oct 2022 — TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function. Se ha detectado que TOTOLINK NR1800X versión V9.1.0u.6279_B20210910, contiene un desbordamiento de pila autenticado por medio del parámetro pppoeUser en la función setOpModeCfg • https://brief-nymphea-813.notion.site/NR1800X-bof-setOpModeCfg-2e286823203c405bbdec4305b0924a02 • CWE-787: Out-of-bounds Write •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-41528
https://notcve.org/view.php?id=CVE-2022-41528
06 Oct 2022 — TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. Se ha detectado que TOTOLINK NR1800X versión V9.1.0u.6279_B20210910, contiene un desbordamiento de pila autenticado por medio del parámetro text en la función setSmsCfg • https://brief-nymphea-813.notion.site/NR1800X-bof-setSmsCfg-0f2be43baa9842d79ae6bafbded574f8 • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 1CVE-2022-40475
https://notcve.org/view.php?id=CVE-2022-40475
29 Sep 2022 — TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi. Se ha detectado que TOTOLINK A860R versión V4.1.2cu.5182_B20201027, contiene una inyección de comandos por medio del componente /cgi-bin/downloadFile.cgi • https://github.com/1759134370/iot/blob/main/TOTOLINK/A860R/6.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 2%CPEs: 2EXPL: 1CVE-2022-38823
https://notcve.org/view.php?id=CVE-2022-38823
16 Sep 2022 — In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. En TOTOLINK T6 V4.1.5cu.709_B20210518, se presenta una contraseña codificada para root en /etc/shadow.sample • https://github.com/whiter6666/CVE/blob/main/TOTOLINK_T6_V3/hard_code.md • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 4%CPEs: 2EXPL: 1CVE-2022-38826
https://notcve.org/view.php?id=CVE-2022-38826
16 Sep 2022 — In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. En TOTOLINK T6 V4.1.5cu.709_B20210518, se presenta un comando de ejecución arbitraria en cstecgi.cgi • https://github.com/whiter6666/CVE/blob/main/TOTOLINK_T6_V3/setStaticDhcpRules_1.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-38827
https://notcve.org/view.php?id=CVE-2022-38827
16 Sep 2022 — TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi TOTOLINK T6 V4.1.5cu.709_B20210518 es vulnerable al desbordamiento del búfer a través de cstecgi.cgi • https://github.com/whiter6666/CVE/blob/main/TOTOLINK_T6_V3/setWiFiWpsStart_2.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 3%CPEs: 2EXPL: 1CVE-2022-38828
https://notcve.org/view.php?id=CVE-2022-38828
16 Sep 2022 — TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi TOTOLINK T6 V4.1.5cu.709_B20210518 es vulnerable a la inyección de comandos a través de cstecgi.cgi • https://github.com/whiter6666/CVE/blob/main/TOTOLINK_T6_V3/setWiFiWpsStart_1.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 1CVE-2022-38535
https://notcve.org/view.php?id=CVE-2022-38535
15 Sep 2022 — TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function. Se ha detectado que TOTOLINK-720R versión v4.1.5cu.374, contiene una vulnerabilidad de ejecución de código remota (RCE) por medio de la función setTracerouteCfg • https://github.com/Jfox816/TOTOLINK-720R/blob/177ee39a5a8557a6bd19586731b0e624548b67ee/totolink%20720%20RCode%20Execution2.md • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •