Ex200 Firmware (Totolink) - vulnerabilities (CVEs)
22 CVEs, 2 in the last 30 days, 5 known versions, newest CVE from 2026-10-21. Vendor: Totolink.
CVEs of Ex200 Firmware
- CVE-2026-114383 - CVSS 10 (critical), 2026-10-21: A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component…
- CVE-2026-114382 - CVSS 10 (critical), 2026-10-21: A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the…
- CVE-2026-11620 - CVSS 6.9 (medium), 2026-06-09: A security flaw has been discovered in TOTOLINK EX200 4.0.3c.7646. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The…
- CVE-2024-53333 - CVSS 6.3 (medium), 2024-11-21: TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to…
- CVE-2024-7336 - CVSS 8.8 (high), 2024-08-01: A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected by this vulnerability is the function loginauth of the file…
- CVE-2024-7335 - CVSS 8.8 (high), 2024-08-01: A vulnerability classified as critical has been found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected is the function getSaveConfig of the file…
- CVE-2024-31810 - CVSS 9.8 (critical), 2024-05-14: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
- CVE-2024-32326 - CVSS 6.8 (medium), 2024-04-18: TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderConfig function.
- CVE-2024-32325 - CVSS 2.4 (low), 2024-04-18: TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderConfig function.
- CVE-2024-31817 - CVSS 7.5 (high), 2024-04-08: In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.
- CVE-2024-31816 - CVSS 7.5 (high), 2024-04-08: In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWizardCfg.
- CVE-2024-31805 - CVSS 6.5 (medium), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to start the Telnet service without authorization via the telnet_enabled parameter in the setTelnetCfg…
- CVE-2024-31808 - CVSS 8.8 (high), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the webWlanIdx parameter in the setWebWlanIdx…
- CVE-2024-31812 - CVSS 6.5 (medium), 2024-04-08: In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getWiFiExtenderConfig.
- CVE-2024-31815 - CVSS 9.1 (critical), 2024-04-08: In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.sh
- CVE-2024-31807 - CVSS 9.8 (critical), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost…
- CVE-2024-31811 - CVSS 8 (high), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg…
- CVE-2024-31814 - CVSS 8.8 (high), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.
- CVE-2024-31806 - CVSS 6.5 (medium), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a Denial-of-Service (DoS) vulnerability in the RebootSystem function which can reboot the…
- CVE-2024-31809 - CVSS 8.8 (high), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW…
- CVE-2024-31813 - CVSS 8.4 (high), 2024-04-08: TOTOLINK EX200 V4.0.3c.7646_B20201211 does not contain an authentication mechanism by default.
- CVE-2021-43711 - CVSS 9.8 (critical), 2022-01-04: The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter…
