https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-61045.htmlhttps://patchthecve.com/cve/CVE-2025-61045.htmlWed, 17 Jun 2026 09:50:16 +0000CRITICAL 9.8: TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the mac parameter in the setEasyMeshAgentCfg function.https://patchthecve.com/cve/CVE-2025-61044.htmlhttps://patchthecve.com/cve/CVE-2025-61044.htmlWed, 17 Jun 2026 09:50:16 +0000CRITICAL 9.8: TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.https://patchthecve.com/cve/CVE-2025-29209.htmlhttps://patchthecve.com/cve/CVE-2025-29209.htmlWed, 17 Jun 2026 09:05:12 +0000CRITICAL 9.8: TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.https://patchthecve.com/cve/CVE-2025-29064.htmlhttps://patchthecve.com/cve/CVE-2025-29064.htmlWed, 17 Jun 2026 09:05:06 +0000CRITICAL 9.8: An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.https://patchthecve.com/cve/CVE-2025-1829.htmlhttps://patchthecve.com/cve/CVE-2025-1829.htmlWed, 17 Jun 2026 08:39:51 +0000MEDIUM 6.3: A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been declared as critical. This vulnerability affects the function setMtknatCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument mtkhnatEnable leads to os command injection. The attack can be initiated remotelhttps://patchthecve.com/cve/CVE-2025-1340.htmlhttps://patchthecve.com/cve/CVE-2025-1340.htmlWed, 17 Jun 2026 08:38:57 +0000HIGH 8.8: A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit hhttps://patchthecve.com/cve/CVE-2025-1339.htmlhttps://patchthecve.com/cve/CVE-2025-1339.htmlWed, 17 Jun 2026 08:38:57 +0000MEDIUM 6.3: A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated remotely. The exploit hhttps://patchthecve.com/cve/CVE-2024-10966.htmlhttps://patchthecve.com/cve/CVE-2024-10966.htmlWed, 17 Jun 2026 06:56:47 +0000MEDIUM 6.3: A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be launched remotely.