Totolink a720r Firmware vulnerabilities

28 CVEs affecting Totolink a720r Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-60686, published 2025-11-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-4270, published 2025-05-05. High severity, CVSS 7.5. EPSS: 14% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The…
CVE-2021-35325, published 2021-08-05. High severity, CVSS 7.5. EPSS: 13.3% chance of exploitation in the next 30 days. A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS).
CVE-2021-35324, published 2021-08-05. Critical severity, CVSS 9.8. EPSS: 10.4% chance of exploitation in the next 30 days. A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.
CVE-2021-27710, published 2021-04-14. Critical severity, CVSS 9.8. EPSS: 7.9% chance of exploitation in the next 30 days. Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS…
CVE-2021-27708, published 2021-04-14. Critical severity, CVSS 9.8. EPSS: 7.6% chance of exploitation in the next 30 days. Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS…
CVE-2021-45742, published 2022-02-04. Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days. TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the…
CVE-2021-44247, published 2022-02-04. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg.…
CVE-2021-35326, published 2021-08-05. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sending a crafted HTTP request.
CVE-2022-38535, published 2022-09-15. High severity, CVSS 7.2. EPSS: 2.1% chance of exploitation in the next 30 days. TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function.
CVE-2022-38534, published 2022-09-15. High severity, CVSS 7.2. EPSS: 2.1% chance of exploitation in the next 30 days. TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.

Latest

CVE-2025-60686, published 2025-11-13. Medium severity, CVSS 5.1. EPSS: 0.2% chance of exploitation in the next 30 days. A local stack-based buffer overflow vulnerability exists in the infostat.cgi and cstecgi.cgi binaries of ToToLink routers (A720R V4.1.5cu.614_B20230630, LR1200GB V9.1.0u.6619_B20230130, and NR1800X…
CVE-2025-60685, published 2025-11-13. Medium severity, CVSS 5.1. EPSS: 0.2% chance of exploitation in the next 30 days. A stack buffer overflow exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary (sub_401EE0 function). The binary reads the /proc/stat file using fgets() into a…
CVE-2025-60683, published 2025-11-13. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the sysconf binary, specifically in the sub_40BFA4 function that handles network interface…
CVE-2025-60682, published 2025-11-13. Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days. A command injection vulnerability exists in the ToToLink A720R Router firmware V4.1.5cu.614_B20230630 within the cloudupdate_check binary, specifically in the sub_402414 function that handles cloud…
CVE-2025-9303, published 2025-08-21. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument…
CVE-2025-4271, published 2025-05-05. Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The…
CVE-2025-4269, published 2025-05-05. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The…
CVE-2025-4268, published 2025-05-05. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument…
CVE-2024-8869, published 2024-09-15. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in TOTOLINK A720R 4.1.5. Affected is the function exportOvpn. The manipulation leads to os command injection. It is possible to launch the attack…