Totolink a950rg Firmware vulnerabilities

33 CVEs affecting Totolink a950rg Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-67189, published 2026-02-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-45797, published 2025-05-08. Critical severity, CVSS 9.8. EPSS: 18.3% chance of exploitation in the next 30 days. TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability. The vulnerability arises from the improper input validation of the NoticeUrl parameter in the setNoticeCfg interface…
CVE-2022-25082, published 2022-02-24. Critical severity, CVSS 9.8. EPSS: 13.7% chance of exploitation in the next 30 days. TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute…
CVE-2022-26210, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 5.7% chance of exploitation in the next 30 days. Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026…
CVE-2022-28935, published 2022-07-06. High severity, CVSS 7.2. EPSS: 3.3% chance of exploitation in the next 30 days. Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128,…
CVE-2022-26214, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026…
CVE-2022-26212, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026…
CVE-2022-26211, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026…
CVE-2022-26208, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026…
CVE-2025-60702, published 2025-11-13. Medium severity, CVSS 6.5. EPSS: 2.5% chance of exploitation in the next 30 days. A command injection vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `system.so` binary. The `setDiagnosisCfg` function retrieves the `ipDoamin`…
CVE-2022-26209, published 2022-03-15. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026…

Latest

CVE-2025-67189, published 2026-02-03. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112. The urlKeyword parameter is not properly validated, and the function concatenates…
CVE-2025-67188, published 2026-02-03. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg interface of the /lib/cste_modules/ipv6.so module. The function fails to…
CVE-2025-67187, published 2026-02-03. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules interface of /lib/cste_modules/firewall.so where the…
CVE-2025-67186, published 2026-02-03. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/firewall.so. The vulnerability occurs because the `url`…
CVE-2025-60699, published 2025-11-13. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592_B20191022_ALL within the `global.so` binary. The `getSaveConfig` function retrieves the `http_host` parameter…
CVE-2025-44655, published 2025-07-21. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use…
CVE-2025-4496, published 2025-05-10. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function…
CVE-2025-45798, published 2025-05-08. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112. The vulnerability is located in the setNoticeCfg interface within the /lib/cste_modules/system.so library,…