Totolink a7000r Firmware vulnerabilities

35 CVEs affecting Totolink a7000r Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1623, published 2026-01-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-28640, published 2024-03-16. High severity, CVSS 7.5. EPSS: 14.2% chance of exploitation in the next 30 days. Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the command field.
CVE-2022-27005, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 5.5% chance of exploitation in the next 30 days. Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the setWanCfg function via the hostName parameter.…
CVE-2026-1548, published 2026-01-28. High severity, CVSS 8.8. EPSS: 3.5% chance of exploitation in the next 30 days. A flaw has been found in Totolink A7000R 4.1cu.4154. This impacts the function CloudACMunualUpdateUserdata of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument url causes command…
CVE-2026-1547, published 2026-01-28. Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days. A vulnerability was detected in Totolink A7000R 4.1cu.4154. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name results in…
CVE-2022-27004, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6in4 function via the remote6in4…
CVE-2022-27003, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter.…
CVE-2026-1623, published 2026-01-29. Medium severity, CVSS 6.3. EPSS: 2.4% chance of exploitation in the next 30 days. A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command…
CVE-2026-1601, published 2026-01-29. Medium severity, CVSS 6.3. EPSS: 2.2% chance of exploitation in the next 30 days. A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument…
CVE-2022-37079, published 2022-08-25. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
CVE-2024-28639, published 2024-03-16. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022, allow remote attackers to execute arbitrary code and cause a denial of service (DoS) via the…

Latest

CVE-2025-63154, published 2025-11-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the addEffect parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of…
CVE-2025-63153, published 2025-11-10. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. TOTOLink A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow in the ssid parameter of the urldecode function. This vulnerability allows attackers to cause a Denial of Service…
CVE-2025-63459, published 2025-10-31. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_421CF0 function. This vulnerability allows attackers to cause a Denial of Service…
CVE-2025-63462, published 2025-10-31. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of…
CVE-2025-63461, published 2025-10-31. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the urldecode function. This vulnerability allows attackers to cause a Denial of Service…
CVE-2025-63460, published 2025-10-31. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the ssid5g parameter in the sub_4222E0 function. This vulnerability allows attackers to cause a Denial of Service…