N300rt Firmware (Totolink) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 8 known versions, newest CVE from 2026-04-28. Vendor: Totolink.
CVEs of N300rt Firmware
- CVE-2026-7219 - CVSS 8.6 (high), 2026-04-28: A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS. Executing a manipulation of the…
- CVE-2026-7218 - CVSS 8.6 (high), 2026-04-28: A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_valid of the file /boafrm/formWsc of the…
- CVE-2025-34319 - CVSS 9.3 (critical), 2025-12-03: TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection…
- CVE-2024-51228 - CVSS 6.8 (medium), 2024-11-27: An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and…
- CVE-2024-32335 - CVSS 5.4 (medium), 2024-04-18: TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Access Control under the Wireless Page.
- CVE-2024-32334 - CVSS 6.5 (medium), 2024-04-18: TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page.
- CVE-2024-32327 - CVSS 5.5 (medium), 2024-04-18: TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in Port Forwarding under the Firewall Page.
- CVE-2024-32333 - CVSS 4.3 (medium), 2024-04-18: TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall Page.
- CVE-2024-32332 - CVSS 6.1 (medium), 2024-04-18: TOTOLINK N300RT V2.1.8-B20201030.1539 contains a Store Cross-site scripting (XSS) vulnerability in WDS Settings under the Wireless Page.
- CVE-2023-48860 - CVSS 9.8 (critical), 2023-12-07: TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security…
- CVE-2020-25499 - CVSS 8.8 (high), 2020-12-09: TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to…
- CVE-2019-19824 - CVSS 8.8 (high), 2020-01-27: On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd…
- CVE-2019-19823 - CVSS 7.5 (high), 2020-01-27: A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory…
- CVE-2019-19822 - CVSS 7.5 (high), 2020-01-27: A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration,…
- CVE-2019-19825 - CVSS 9.8 (critical), 2020-01-27: On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI,…
