https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-4496.htmlhttps://patchthecve.com/cve/CVE-2025-4496.htmlWed, 17 Jun 2026 09:33:22 +0000HIGH 8.8: A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to bufferhttps://patchthecve.com/cve/CVE-2025-45790.htmlhttps://patchthecve.com/cve/CVE-2025-45790.htmlWed, 17 Jun 2026 09:25:42 +0000CRITICAL 9.8: TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of /lib/cste_modules/firewall.so.https://patchthecve.com/cve/CVE-2025-45789.htmlhttps://patchthecve.com/cve/CVE-2025-45789.htmlWed, 17 Jun 2026 09:25:42 +0000CRITICAL 9.8: TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules.https://patchthecve.com/cve/CVE-2025-45788.htmlhttps://patchthecve.com/cve/CVE-2025-45788.htmlWed, 17 Jun 2026 09:25:42 +0000CRITICAL 9.8: TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules.https://patchthecve.com/cve/CVE-2025-45787.htmlhttps://patchthecve.com/cve/CVE-2025-45787.htmlWed, 17 Jun 2026 09:25:42 +0000CRITICAL 9.8: TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules.https://patchthecve.com/cve/CVE-2025-28028.htmlhttps://patchthecve.com/cve/CVE-2025-28028.htmlWed, 17 Jun 2026 09:04:29 +0000HIGH 7.3: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v5 parameter.https://patchthecve.com/cve/CVE-2025-28025.htmlhttps://patchthecve.com/cve/CVE-2025-28025.htmlWed, 17 Jun 2026 09:04:28 +0000HIGH 7.3: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.https://patchthecve.com/cve/CVE-2025-28036.htmlhttps://patchthecve.com/cve/CVE-2025-28036.htmlWed, 17 Jun 2026 09:04:30 +0000CRITICAL 9.8: TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.https://patchthecve.com/cve/CVE-2025-28035.htmlhttps://patchthecve.com/cve/CVE-2025-28035.htmlWed, 17 Jun 2026 09:04:30 +0000CRITICAL 9.8: TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.https://patchthecve.com/cve/CVE-2025-28029.htmlhttps://patchthecve.com/cve/CVE-2025-28029.htmlWed, 17 Jun 2026 09:04:29 +0000HIGH 7.3: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in cstecgi.cgihttps://patchthecve.com/cve/CVE-2025-28027.htmlhttps://patchthecve.com/cve/CVE-2025-28027.htmlWed, 17 Jun 2026 09:04:29 +0000HIGH 7.3: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 was found to contain a buffer overflow vulnerability in downloadFile.cgi.https://patchthecve.com/cve/CVE-2025-28026.htmlhttps://patchthecve.com/cve/CVE-2025-28026.htmlWed, 17 Jun 2026 09:04:28 +0000HIGH 7.3: TOTOLINK A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a buffer overflow vulnerability in downloadFile.cgi.https://patchthecve.com/cve/CVE-2025-28034.htmlhttps://patchthecve.com/cve/CVE-2025-28034.htmlWed, 17 Jun 2026 09:04:30 +0000CRITICAL 9.8: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost functihttps://patchthecve.com/cve/CVE-2025-28033.htmlhttps://patchthecve.com/cve/CVE-2025-28033.htmlWed, 17 Jun 2026 09:04:29 +0000HIGH 7.3: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through thttps://patchthecve.com/cve/CVE-2025-28032.htmlhttps://patchthecve.com/cve/CVE-2025-28032.htmlWed, 17 Jun 2026 09:04:29 +0000HIGH 7.3: TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 contain a pre-auth buffer overflow vulnerability in the setNoticeCfg function through the IpForm parahttps://patchthecve.com/cve/CVE-2025-28256.htmlhttps://patchthecve.com/cve/CVE-2025-28256.htmlWed, 17 Jun 2026 09:04:41 +0000CRITICAL 9.8: An issue in TOTOLINK A3100R V4.1.2cu.5247_B20211129 allows a remote attacker to execute arbitrary code via the setWebWlanIdx of the file /lib/cste_modules/wireless.so.https://patchthecve.com/cve/CVE-2024-42547.htmlhttps://patchthecve.com/cve/CVE-2024-42547.htmlWed, 17 Jun 2026 07:49:37 +0000CRITICAL 9.8: TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the http_host parameter in the loginauth function.https://patchthecve.com/cve/CVE-2024-42546.htmlhttps://patchthecve.com/cve/CVE-2024-42546.htmlWed, 17 Jun 2026 07:49:37 +0000CRITICAL 9.8: TOTOLINK A3100R V4.1.2cu.5050_B20200504 has a buffer overflow vulnerability in the password parameter in the loginauth function.https://patchthecve.com/cve/CVE-2024-7158.htmlhttps://patchthecve.com/cve/CVE-2024-7158.htmlWed, 17 Jun 2026 08:19:28 +0000MEDIUM 6.3: A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been declared as critical. This vulnerability affects the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument telnet_enabled leads to command inhttps://patchthecve.com/cve/CVE-2024-7157.htmlhttps://patchthecve.com/cve/CVE-2024-7157.htmlWed, 17 Jun 2026 08:19:27 +0000HIGH 8.8: A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050_B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument http_host leads to buffer overflow. It is possible to initiate the ahttps://patchthecve.com/cve/CVE-2024-36650.htmlhttps://patchthecve.com/cve/CVE-2024-36650.htmlWed, 17 Jun 2026 07:37:03 +0000HIGH 7.5: TOTOLINK AC1200 Wireless Dual Band Gigabit Router firmware A3100R V4.1.2cu.5247_B20211129, in the cgi function `setNoticeCfg` of the file `/lib/cste_modules/system.so`, the length of the user input string `NoticeUrl` is not checked. This can lead to a buffer overflow, allowing attackers to construct