Patchfirst: totolink vulnerabilitieshttps://patchfirst.co/vendor/totolink/New and newly exploited totolink CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 13:00:36 GMTCVE-2026-116505: A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116505/CVE-2026-116505Mon, 26 Oct 2026 00:00:00 GMTTOTOLINK · A950RG. Not in CISA KEV. EPSS 2.7% (higher than 86.1% of CVEs). CVSS 9.1 CRITICAL. Priority 25.2 of 100.CVE-2026-116506: A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116506/CVE-2026-116506Mon, 26 Oct 2026 00:00:00 GMTTOTOLINK · A950RG. Not in CISA KEV. EPSS 1.9% (higher than 79.4% of CVEs). CVSS 9.9 CRITICAL. Priority 24.4 of 100.CVE-2026-116504: A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116504/CVE-2026-116504Mon, 26 Oct 2026 00:00:00 GMTTOTOLINK · A950RG. Not in CISA KEV. EPSS 1.5% (higher than 75% of CVEs). CVSS 9.9 CRITICAL. Priority 23.5 of 100.CVE-2026-116508: A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-116508/CVE-2026-116508Mon, 26 Oct 2026 00:00:00 GMTTOTOLINK · A950RG. Not in CISA KEV. EPSS 0.6% (higher than 49.1% of CVEs). CVSS 10.0 CRITICAL. Priority 18.4 of 100.CVE-2026-114575: A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104https://patchfirst.co/cve/CVE-2026-114575/CVE-2026-114575Thu, 22 Oct 2026 00:00:00 GMTTOTOLINK · A950RG. Not in CISA KEV. EPSS 2.2% (higher than 82.6% of CVEs). CVSS 10.0 CRITICAL. Priority 25.4 of 100.CVE-2026-114382: A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200https://patchfirst.co/cve/CVE-2026-114382/CVE-2026-114382Wed, 21 Oct 2026 00:00:00 GMTTOTOLINK · EX200. Not in CISA KEV. EPSS 0.7% (higher than 51.8% of CVEs). CVSS 10.0 CRITICAL. Priority 19.3 of 100.CVE-2026-114383: A weakness has been identified in TOTOLINK EX200 5.2.3c.7200https://patchfirst.co/cve/CVE-2026-114383/CVE-2026-114383Wed, 21 Oct 2026 00:00:00 GMTTOTOLINK · EX200. Not in CISA KEV. EPSS 0.7% (higher than 51.3% of CVEs). CVSS 10.0 CRITICAL. Priority 19.2 of 100.CVE-2026-9814: An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-9814/CVE-2026-9814Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 1.6% (higher than 75.8% of CVEs). CVSS 9.1 CRITICAL. Priority 23.4 of 100.CVE-2026-10138: A OS command injection vulnerability exists in the boa formUpload() functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10138/CVE-2026-10138Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 1.4% (higher than 73.3% of CVEs). CVSS 9.1 CRITICAL. Priority 22.9 of 100.CVE-2026-10135: A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10135/CVE-2026-10135Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 1.4% (higher than 72.2% of CVEs). CVSS 9.1 CRITICAL. Priority 22.7 of 100.CVE-2026-10131: An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10131/CVE-2026-10131Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 1.4% (higher than 72.2% of CVEs). CVSS 9.1 CRITICAL. Priority 22.7 of 100.CVE-2026-35499: An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R…https://patchfirst.co/cve/CVE-2026-35499/CVE-2026-35499Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 1.3% (higher than 70.1% of CVEs). CVSS 9.1 CRITICAL. Priority 22.3 of 100.CVE-2026-40627: An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R…https://patchfirst.co/cve/CVE-2026-40627/CVE-2026-40627Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 1.0% (higher than 64.1% of CVEs). CVSS 9.1 CRITICAL. Priority 21.1 of 100.CVE-2026-33568: A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-33568/CVE-2026-33568Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 1.0% (higher than 64.1% of CVEs). CVSS 9.1 CRITICAL. Priority 21.1 of 100.CVE-2026-9659: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R…https://patchfirst.co/cve/CVE-2026-9659/CVE-2026-9659Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.8% (higher than 56.2% of CVEs). CVSS 9.1 CRITICAL. Priority 19.5 of 100.CVE-2026-42020: Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink…https://patchfirst.co/cve/CVE-2026-42020/CVE-2026-42020Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.2 of 100.CVE-2026-42019: Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink…https://patchfirst.co/cve/CVE-2026-42019/CVE-2026-42019Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.2 of 100.CVE-2026-41223: A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R…https://patchfirst.co/cve/CVE-2026-41223/CVE-2026-41223Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.2 of 100.CVE-2026-41222: A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R…https://patchfirst.co/cve/CVE-2026-41222/CVE-2026-41222Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.2 of 100.CVE-2026-40615: A stack-based buffer overflow vulnerability exists in the boa formParentControl deviceName functionality of X2000R…https://patchfirst.co/cve/CVE-2026-40615/CVE-2026-40615Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.2 of 100.CVE-2026-28763: A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R…https://patchfirst.co/cve/CVE-2026-28763/CVE-2026-28763Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.7% (higher than 54.5% of CVEs). CVSS 9.1 CRITICAL. Priority 19.2 of 100.CVE-2026-9827: A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-9827/CVE-2026-9827Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.6% (higher than 50.3% of CVEs). CVSS 9.1 CRITICAL. Priority 18.3 of 100.CVE-2026-10139: A stack-based buffer overflow vulnerability exists in the Mcli functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10139/CVE-2026-10139Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.6% (higher than 49.9% of CVEs). CVSS 9.1 CRITICAL. Priority 18.3 of 100.CVE-2026-10137: A stack-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10137/CVE-2026-10137Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.6% (higher than 48.6% of CVEs). CVSS 9.1 CRITICAL. Priority 18.0 of 100.CVE-2026-10136: A heap-based buffer overflow vulnerability exists in the boa formUpload() functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10136/CVE-2026-10136Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.6% (higher than 48.6% of CVEs). CVSS 9.1 CRITICAL. Priority 18.0 of 100.CVE-2026-10133: A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10133/CVE-2026-10133Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.6% (higher than 48.6% of CVEs). CVSS 9.1 CRITICAL. Priority 18.0 of 100.CVE-2026-10132: A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-10132/CVE-2026-10132Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.6% (higher than 48.6% of CVEs). CVSS 9.1 CRITICAL. Priority 18.0 of 100.CVE-2026-9869: A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-9869/CVE-2026-9869Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-9817: A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s)…https://patchfirst.co/cve/CVE-2026-9817/CVE-2026-9817Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-9660: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R…https://patchfirst.co/cve/CVE-2026-9660/CVE-2026-9660Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-42026: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality…https://patchfirst.co/cve/CVE-2026-42026/CVE-2026-42026Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-42025: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality…https://patchfirst.co/cve/CVE-2026-42025/CVE-2026-42025Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-42024: Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration…https://patchfirst.co/cve/CVE-2026-42024/CVE-2026-42024Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-42023: Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration…https://patchfirst.co/cve/CVE-2026-42023/CVE-2026-42023Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 43.7% of CVEs). CVSS 9.1 CRITICAL. Priority 17.0 of 100.CVE-2026-42022: Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration…https://patchfirst.co/cve/CVE-2026-42022/CVE-2026-42022Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 41.2% of CVEs). CVSS 9.1 CRITICAL. Priority 16.5 of 100.CVE-2026-42021: Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration…https://patchfirst.co/cve/CVE-2026-42021/CVE-2026-42021Tue, 20 Oct 2026 00:00:00 GMTtotolink · Totolink. Not in CISA KEV. EPSS 0.5% (higher than 41.2% of CVEs). CVSS 9.1 CRITICAL. Priority 16.5 of 100.CVE-2026-105484: A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116https://patchfirst.co/cve/CVE-2026-105484/CVE-2026-105484Tue, 06 Oct 2026 00:00:00 GMTTOTOLINK · X6000R. Not in CISA KEV. EPSS 2.1% (higher than 81.9% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 30.5 of 100.public-exploitCVE-2026-105284: A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455https://patchfirst.co/cve/CVE-2026-105284/CVE-2026-105284Mon, 05 Oct 2026 00:00:00 GMTTotolink · A3002MU. Not in CISA KEV. EPSS 0.8% (higher than 57.5% of CVEs). CVSS 10.0 CRITICAL. Priority 20.7 of 100.CVE-2026-105285: A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455https://patchfirst.co/cve/CVE-2026-105285/CVE-2026-105285Mon, 05 Oct 2026 00:00:00 GMTTotolink · A3002MU. Not in CISA KEV. EPSS 0.6% (higher than 50.8% of CVEs). CVSS 10.0 CRITICAL. Priority 19.3 of 100.CVE-2026-1623: Totolink A7000R cstecgi.cgi setUpgradeFW command injectionhttps://patchfirst.co/cve/CVE-2026-1623/CVE-2026-1623Thu, 29 Jan 2026 00:00:00 GMTTotolink · A7000R. Not in CISA KEV. EPSS 2.4% (higher than 83.9% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 66.2 of 100.public-exploitCVE-2026-1547: Totolink A7000R cstecgi.cgi setUnloadUserData command injectionhttps://patchfirst.co/cve/CVE-2026-1547/CVE-2026-1547Wed, 28 Jan 2026 00:00:00 GMTTotolink · A7000R. Not in CISA KEV. EPSS 3.0% (higher than 87.5% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 71.9 of 100.public-exploitCVE-2025-14586: TOTOLINK X5000R cstecgi.cgi snprintf os command injectionhttps://patchfirst.co/cve/CVE-2025-14586/CVE-2025-14586Sat, 13 Dec 2025 00:00:00 GMTTOTOLINK · X5000R. Not in CISA KEV. EPSS 2.8% (higher than 86.2% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 66.7 of 100.public-exploitCVE-2025-52907: TOTOLINK X6000R Security Bypass Vulnerabilityhttps://patchfirst.co/cve/CVE-2025-52907/CVE-2025-52907Wed, 24 Sep 2025 00:00:00 GMTTOTOLINK · X6000R. Not in CISA KEV. EPSS 0.9% (higher than 58.3% of CVEs). CVSS 7.3 HIGH. Priority 63.1 of 100.CVE-2025-8937: TOTOLINK N350R formSysCmd command injectionhttps://patchfirst.co/cve/CVE-2025-8937/CVE-2025-8937Thu, 14 Aug 2025 00:00:00 GMTTOTOLINK · N350R. Not in CISA KEV. EPSS 2.1% (higher than 82% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 65.8 of 100.public-exploitCVE-2025-6485: TOTOLINK A3002R formWlSiteSurvey os command injectionhttps://patchfirst.co/cve/CVE-2025-6485/CVE-2025-6485Sun, 22 Jun 2025 00:00:00 GMTTOTOLINK · A3002R. Not in CISA KEV. EPSS 9.3% (higher than 95.4% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 68.5 of 100.public-exploitCVE-2025-5504: TOTOLINK X2000R formWsc command injectionhttps://patchfirst.co/cve/CVE-2025-5504/CVE-2025-5504Tue, 03 Jun 2025 00:00:00 GMTTOTOLINK · X2000R. Not in CISA KEV. EPSS 14.0% (higher than 96.5% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 66.2 of 100.public-exploitCVE-2025-4270: TOTOLINK A720R Config cstecgi.cgi information disclosurehttps://patchfirst.co/cve/CVE-2025-4270/CVE-2025-4270Mon, 05 May 2025 00:00:00 GMTTOTOLINK · A720R. Not in CISA KEV. EPSS 14.0% (higher than 96.6% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 63.0 of 100.public-exploitCVE-2025-3987: TOTOLINK N150RT formWsc command injectionhttps://patchfirst.co/cve/CVE-2025-3987/CVE-2025-3987Sun, 27 Apr 2025 00:00:00 GMTTOTOLINK · N150RT. Not in CISA KEV. EPSS 11.3% (higher than 96% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 63.6 of 100.public-exploitCVE-2025-1829: TOTOLINK X18 cstecgi.cgi setMtknatCfg os command injectionhttps://patchfirst.co/cve/CVE-2025-1829/CVE-2025-1829Sun, 02 Mar 2025 00:00:00 GMTTOTOLINK · X18. Not in CISA KEV. EPSS 12.4% (higher than 96.2% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 66.0 of 100.public-exploitCVE-2024-9001: TOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injectionhttps://patchfirst.co/cve/CVE-2024-9001/CVE-2024-9001Thu, 19 Sep 2024 00:00:00 GMTTOTOLINK · T10. Not in CISA KEV. EPSS 3.3% (higher than 88.6% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 62.1 of 100.public-exploit