A3300r Firmware (Totolink) - vulnerabilities (CVEs)

65 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2026-04-23. Vendor: Totolink.

CVEs of A3300r Firmware

• CVE-2026-31173 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the interval parameter to…
• CVE-2026-31169 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to…
• CVE-2026-31163 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the dhcpMtu parameter to…
• CVE-2026-31168 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the recHour parameter to…
• CVE-2026-31162 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the ttlWay parameter to…
• CVE-2026-31167 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to…
• CVE-2026-31166 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to…
• CVE-2026-31179 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunPort parameter to…
• CVE-2026-31178 - CVSS 9.8 (critical), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMaxAlive parameter to…
• CVE-2026-31181 - CVSS 9.8 (critical), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunServerAddr parameter…
• CVE-2026-31176 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun_user parameter to…
• CVE-2026-31160 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to…
• CVE-2026-31171 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the url parameter to…
• CVE-2026-31175 - CVSS 9.8 (critical), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to…
• CVE-2026-31159 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to…
• CVE-2026-31165 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName…
• CVE-2026-31174 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the informEnable parameter to…
• CVE-2026-31177 - CVSS 9.8 (critical), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to…
• CVE-2026-31164 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeMtu parameter to…
• CVE-2026-31172 - CVSS 6.5 (medium), 2026-04-23: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the user parameter to…
• CVE-2026-31170 - CVSS 9.8 (critical), 2026-04-09: An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stun-pass parameter to…
• CVE-2026-5679 - CVSS 5.5 (medium), 2026-04-06: A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_B20221024. The impacted element is the function vsetTr069Cfg of the file…
• CVE-2026-5178 - CVSS 8.8 (high), 2026-03-31: A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this issue is the function setIptvCfg of the file…
• CVE-2026-5177 - CVSS 8.8 (high), 2026-03-31: A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. Affected by this vulnerability is the function setWiFiBasicCfg of the file…
• CVE-2026-5176 - CVSS 9.8 (critical), 2026-03-31: A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. Affected is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi.…
• CVE-2026-5105 - CVSS 8.8 (high), 2026-03-30: A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of…
• CVE-2026-5104 - CVSS 8.8 (high), 2026-03-30: A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Impacted is the function setStaticRoute of the file…
• CVE-2026-5103 - CVSS 8.8 (high), 2026-03-30: A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This…
• CVE-2026-5102 - CVSS 8.8 (high), 2026-03-30: A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function setSmartQosCfg of the file…
• CVE-2026-5101 - CVSS 8.8 (high), 2026-03-29: A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the file /cgi-bin/cstecgi.cgi of the…
• CVE-2025-55895 - CVSS 9.1 (critical), 2025-12-15: TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can…
• CVE-2025-55901 - CVSS 6.5 (medium), 2025-12-15: TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter.
• CVE-2025-12258 - CVSS 8.8 (high), 2025-10-27: A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. Impacted is the function setOpModeCfg of the file /cgi-bin/cstecgi.cg of the component…
• CVE-2025-12260 - CVSS 8.8 (high), 2025-10-27: A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi…
• CVE-2025-12259 - CVSS 8.8 (high), 2025-10-27: A flaw has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi of the…
• CVE-2025-12239 - CVSS 9.8 (critical), 2025-10-27: A weakness has been identified in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi.…
• CVE-2025-12241 - CVSS 8.8 (high), 2025-10-27: A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the…
• CVE-2025-12240 - CVSS 9.8 (critical), 2025-10-27: A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi.…
• CVE-2025-52046 - CVSS 9.8 (critical), 2025-07-17: Totolink A3300R V17.0.0cu.596_B20250515 was found to contain a command injection vulnerability in the sub_4197C0 function via the mac and desc parameters.…
• CVE-2024-7331 - CVSS 8.8 (high), 2024-08-01: A vulnerability was found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as critical. Affected by this issue is the function UploadCustomModule of…
• CVE-2024-7155 - CVSS 4.7 (medium), 2024-07-28: A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024 and classified as problematic. Affected by this vulnerability is an unknown…
• CVE-2024-27521 - CVSS 8 (high), 2024-03-26: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multiple parameters in…
• CVE-2024-24332 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function.
• CVE-2024-24325 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function.
• CVE-2024-24328 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.
• CVE-2024-24331 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function.
• CVE-2024-24327 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function.
• CVE-2024-24330 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the setRemoteCfg…
• CVE-2024-24333 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function.
• CVE-2024-24326 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setStaticDhcpRules…
• CVE-2024-24329 - CVSS 9.8 (critical), 2024-01-30: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules…
• CVE-2024-23059 - CVSS 9.8 (critical), 2024-01-11: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdnsCfg function.
• CVE-2024-23061 - CVSS 9.8 (critical), 2024-01-11: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setScheduleCfg function.
• CVE-2024-23060 - CVSS 9.8 (critical), 2024-01-11: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg function.
• CVE-2024-22942 - CVSS 9.8 (critical), 2024-01-11: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWanCfg function.
• CVE-2024-23058 - CVSS 9.8 (critical), 2024-01-11: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cfg function.
• CVE-2024-23057 - CVSS 9.8 (critical), 2024-01-11: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg function.
• CVE-2023-46993 - CVSS 9.8 (critical), 2023-10-31: In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable parameter, which can lead to command…
• CVE-2023-46992 - CVSS 7.5 (high), 2023-10-31: TOTOLINK A3300R V17.0.0cu.557_B20221024 is vulnerable to Incorrect Access Control. Attackers are able to reset serveral critical passwords without…
• CVE-2023-46976 - CVSS 9.8 (critical), 2023-10-31: TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function.
• CVE-2023-37170 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the…
• CVE-2023-37173 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
• CVE-2023-37172 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
• CVE-2023-37171 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
• CVE-2023-31729 - CVSS 9.8 (critical), 2023-05-18: TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.