Lr350 Firmware (Totolink) - vulnerabilities (CVEs)

36 CVEs, 0 in the last 30 days, 5 known versions, newest CVE from 2026-03-27. Vendor: Totolink.

CVEs of Lr350 Firmware

• CVE-2026-4976 - CVSS 8.8 (high), 2026-03-27: A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi.…
• CVE-2026-1158 - CVSS 8.8 (high), 2026-01-19: A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file…
• CVE-2026-1157 - CVSS 8.8 (high), 2026-01-19: A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such…
• CVE-2026-1156 - CVSS 8.8 (high), 2026-01-19: A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file…
• CVE-2026-1155 - CVSS 8.8 (high), 2026-01-19: A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file…
• CVE-2026-1150 - CVSS 8.8 (high), 2026-01-19: A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. Impacted is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the…
• CVE-2026-1149 - CVSS 8.8 (high), 2026-01-19: A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of…
• CVE-2025-63465 - CVSS 7.5 (high), 2025-10-31: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_422880 function. This vulnerability allows…
• CVE-2025-63464 - CVSS 7.5 (high), 2025-10-31: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_42396C function. This vulnerability allows…
• CVE-2025-63463 - CVSS 7.5 (high), 2025-10-31: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the wifiOff parameter in the sub_4232EC function. This vulnerability…
• CVE-2025-63469 - CVSS 7.5 (high), 2025-10-31: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_421BAC function. This vulnerability allows…
• CVE-2025-63468 - CVSS 7.5 (high), 2025-10-31: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the sub_426EF8 function. This vulnerability…
• CVE-2025-63466 - CVSS 7.5 (high), 2025-10-31: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the sub_426EF8 function. This vulnerability…
• CVE-2025-63467 - CVSS 7.5 (high), 2025-10-31: Totolink LR350 v9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the ssid parameter in the sub_425400 function. This vulnerability allows…
• CVE-2024-10654 - CVSS 9.1 (critical), 2024-11-01: A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of…
• CVE-2024-42967 - CVSS 9.8 (critical), 2024-08-15: Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the…
• CVE-2024-7214 - CVSS 8.8 (high), 2024-07-30: A vulnerability has been found in TOTOLINK LR350 9.3.5u.6369_B20220309 and classified as critical. Affected by this vulnerability is the function setWanCfg of…
• CVE-2024-36783 - CVSS 9.8 (critical), 2024-06-03: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function.
• CVE-2024-35387 - CVSS 9.8 (critical), 2024-05-24: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth.
• CVE-2024-35099 - CVSS 9.8 (critical), 2024-05-14: TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth.
• CVE-2024-34308 - CVSS 8.8 (high), 2024-05-14: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode.
• CVE-2023-37146 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.
• CVE-2023-37145 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.
• CVE-2023-37149 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function.
• CVE-2023-37148 - CVSS 9.8 (critical), 2023-07-07: TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function.
• CVE-2022-44260 - CVSS 8.8 (high), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function.
• CVE-2022-44251 - CVSS 9.8 (critical), 2022-11-23: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
• CVE-2022-44254 - CVSS 8.8 (high), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function.
• CVE-2022-44258 - CVSS 8.8 (high), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function.
• CVE-2022-44250 - CVSS 9.8 (critical), 2022-11-23: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.
• CVE-2022-44253 - CVSS 8.8 (high), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.
• CVE-2022-44257 - CVSS 8.8 (high), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.
• CVE-2022-44249 - CVSS 9.8 (critical), 2022-11-23: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.
• CVE-2022-44252 - CVSS 9.8 (critical), 2022-11-23: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
• CVE-2022-44255 - CVSS 9.8 (critical), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
• CVE-2022-44259 - CVSS 8.8 (high), 2022-11-23: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.