Totolink CP900 Firmware vulnerabilities

13 CVEs affecting Totolink CP900 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-44838, published 2025-05-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-7464, published 2024-08-05. Critical severity, CVSS 9.8. EPSS: 19.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in TOTOLINK CP900 6.3c.566. This issue affects the function setTelnetCfg of the component Telnet Service. The manipulation of the…
CVE-2024-7463, published 2024-08-05. Critical severity, CVSS 9.8. EPSS: 11% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK CP900 6.3c.566. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the…
CVE-2022-28491, published 2023-03-23. Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days. TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vulnerability allows attackers to execute…
CVE-2022-28494, published 2023-03-23. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename parameter. This vulnerability allows attackers…
CVE-2022-28495, published 2023-03-24. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows…
CVE-2022-28496, published 2023-03-23. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adminpassparameter. This vulnerability…
CVE-2022-28497, published 2023-03-23. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename parameter. This vulnerability allows…
CVE-2022-28492, published 2023-03-23. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.
CVE-2025-44838, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers…
CVE-2025-44837, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability…

Latest

CVE-2025-44836, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows…
CVE-2025-44854, published 2025-05-01. Medium severity, CVSS 6.3. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute…
CVE-2022-28493, published 2023-03-23. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,