Totolink CP300+ Firmware vulnerabilities

6 CVEs affecting Totolink CP300+ Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-36955, published 2023-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-31856, published 2023-05-16. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http…
CVE-2023-36954, published 2023-10-16. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36953, published 2023-10-16. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36955, published 2023-10-16. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. TOTOLINK CP300+ <=V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the File parameter in the function UploadCustomModule.
CVE-2023-36952, published 2023-10-16. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. TOTOLINK CP300+ V5.2cu.7594_B20200910 was discovered to contain a stack overflow via the pingIp parameter in the function setDiagnosisCfg.
CVE-2023-34669, published 2023-07-17. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. TOTOLINK CP300+ V5.2cu.7594 contains a Denial of Service vulnerability in function RebootSystem of the file lib/cste_modules/system which can reboot the system.