Cp300+ Firmware (Totolink) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2023-10-16. Vendor: Totolink.

CVEs of Cp300+ Firmware

• CVE-2023-36955 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
• CVE-2023-36954 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
• CVE-2023-36953 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
• CVE-2023-36952 - CVSS 9.8 (critical), 2023-10-16: TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.
• CVE-2023-34669 - CVSS 7.5 (high), 2023-07-17: TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.
• CVE-2023-31856 - CVSS 9.8 (critical), 2023-05-16: A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to…