Totolink EX1200T Firmware vulnerabilities

37 CVEs affecting Totolink EX1200T Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-51451, published 2025-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-42887, published 2022-06-03. Critical severity, CVSS 9.8. EPSS: 44.3% chance of exploitation in the next 30 days. In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
CVE-2021-42872, published 2022-06-02. Critical severity, CVSS 9.8. EPSS: 6.6% chance of exploitation in the next 30 days. TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.
CVE-2025-5907, published 2025-06-10. High severity, CVSS 8.8. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK EX1200T up to 4.1.2cu.5232_B20210713. This vulnerability affects unknown code of the file /boafrm/formFilter of the component HTTP POST…
CVE-2025-5792, published 2025-06-06. Medium severity, CVSS 6.5. EPSS: 5.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formWlanRedirect of the…
CVE-2021-42875, published 2022-06-02. Critical severity, CVSS 9.8. EPSS: 4.4% chance of exploitation in the next 30 days. TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.
CVE-2022-25008, published 2022-03-30. High severity, CVSS 8.8. EPSS: 4.4% chance of exploitation in the next 30 days. totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.
CVE-2021-42885, published 2022-06-03. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to attack.
CVE-2021-42884, published 2022-06-03. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack.
CVE-2021-42886, published 2022-06-03. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found…
CVE-2021-42890, published 2022-06-03. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime to attack.

Latest

CVE-2025-51451, published 2025-08-13. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
CVE-2025-6568, published 2025-06-24. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formIpv6Setup of the component HTTP POST Request…
CVE-2025-6393, published 2025-06-21. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713. It has been classified as critical.…
CVE-2025-6336, published 2025-06-20. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. It has been classified as critical. Affected is an unknown function of the file /boafrm/formTmultiAP of the component HTTP POST…
CVE-2025-6302, published 2025-06-20. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi. The…
CVE-2025-6162, published 2025-06-17. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formMultiAP of the…
CVE-2025-6145, published 2025-06-16. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this issue is some unknown functionality of the file /boafrm/formSysLog of the component…
CVE-2025-6144, published 2025-06-16. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /boafrm/formSysCmd of the…
CVE-2025-6143, published 2025-06-16. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formNtp of the component HTTP POST Request…
CVE-2025-6130, published 2025-06-16. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the file /boafrm/formStats of the component…