Totolink Lr350 Firmware
36 CVEs affecting Totolink Lr350 Firmware. Latest disclosed: 2026-03-27. Critical: 13, High: 19.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-42967 | Critical | 9.8 | 2024-08-15 | Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the… |
CVE-2024-36783 | Critical | 9.8 | 2024-06-03 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function. |
CVE-2024-35387 | Critical | 9.8 | 2024-05-24 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the http_host parameter in the function loginAuth. |
CVE-2024-35099 | Critical | 9.8 | 2024-05-14 | TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth. |
CVE-2023-37149 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadSetting function. |
CVE-2023-37148 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the ussd parameter in the setUssd function. |
CVE-2023-37146 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function. |
CVE-2023-37145 | Critical | 9.8 | 2023-07-07 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function. |
CVE-2022-44255 | Critical | 9.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data. |
CVE-2022-44252 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function. |
CVE-2022-44251 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function. |
CVE-2022-44250 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function. |
CVE-2022-44249 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function. |
CVE-2026-4976 | High | 8.8 | 2026-03-27 | A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi. Th… |
CVE-2026-1158 | High | 8.8 | 2026-01-19 | A security flaw has been discovered in Totolink LR350 9.3.5u.6369_B20220309. This vulnerability affects the function setWizardCfg of the file /cgi-bin/cstecgi… |
CVE-2026-1157 | High | 8.8 | 2026-01-19 | A vulnerability was identified in Totolink LR350 9.3.5u.6369_B20220309. This affects the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi. Such manipul… |
CVE-2026-1156 | High | 8.8 | 2026-01-19 | A vulnerability was determined in Totolink LR350 9.3.5u.6369_B20220309. Affected by this issue is the function setWiFiBasicCfg of the file /cgi-bin/cstecgi.cgi… |
CVE-2026-1155 | High | 8.8 | 2026-01-19 | A vulnerability was found in Totolink LR350 9.3.5u.6369_B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cste… |
CVE-2024-34308 | High | 8.8 | 2024-05-14 | TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a stack overflow via the password parameter in the function urldecode. |
CVE-2022-44260 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function. |