Totolink a7100ru Firmware vulnerabilities

37 CVEs affecting Totolink a7100ru Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-44655, published 2025-07-21.

More from Totolink.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-7095, published 2023-12-25. Critical severity, CVSS 9.8. EPSS: 13.7% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login…
• CVE-2022-28584, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setWiFiWpsStart interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands…
• CVE-2022-28583, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setWiFiWpsCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands…
• CVE-2022-28582, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setWiFiSignalCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary…
• CVE-2022-28581, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setWiFiAdvancedCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary…
• CVE-2022-28580, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setL2tpServerCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary…
• CVE-2022-28579, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary…
• CVE-2022-28578, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setOpenVpnCfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary commands…
• CVE-2022-28577, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the delParentalRules interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows an attacker to execute arbitrary…
• CVE-2022-28575, published 2022-05-05. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. It is found that there is a command injection vulnerability in the setopenvpnclientcfg interface in TOTOlink A7100RU (v7.4cu.2313_b20191024) router, which allows attackers to execute arbitrary…

Latest

• CVE-2025-44655, published 2025-07-21. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use…
• CVE-2023-6906, published 2023-12-18. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in Totolink A7100RU 7.4cu.2313_B20191024. Affected is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component…
• CVE-2023-33556, published 2023-06-07. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/setWanIeCfg.
• CVE-2023-30054, published 2023-05-05. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.
• CVE-2023-30053, published 2023-05-05. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.
• CVE-2023-26978, published 2023-04-07. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting/setWanIeCfg.
• CVE-2023-26848, published 2023-04-07. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStaticDhcpRules.
• CVE-2023-27232, published 2023-03-28. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting/setWanIeCfg.
• CVE-2023-27231, published 2023-03-28. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setWanIeCfg.