CVE-2023-36947: Totolink a7000r Firmware

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.

Affected products

• Totolink a7000r Firmware: version 9.1.0u.6115_b20201022 only
• Totolink x5000r Firmware: version 9.1.0u.6118_b20201102 only

Published 2023-10-16. Last modified 2026-06-17.