Totolink EX200 Firmware vulnerabilities

19 CVEs affecting Totolink EX200 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-53333, published 2024-11-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-31817, published 2024-04-08. High severity, CVSS 7.5. EPSS: 55.3% chance of exploitation in the next 30 days. In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.
CVE-2021-43711, published 2022-01-04. Critical severity, CVSS 9.8. EPSS: 37.8% chance of exploitation in the next 30 days. The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter name can be constructed for…
CVE-2024-53333, published 2024-11-21. Medium severity, CVSS 6.3. EPSS: 19.9% chance of exploitation in the next 30 days. TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to execute arbitrary commands via the…
CVE-2024-31814, published 2024-04-08. High severity, CVSS 8.8. EPSS: 8.3% chance of exploitation in the next 30 days. TOTOLINK EX200 V4.0.3c.7646_B20201211 allows attackers to bypass login through the Form_Login function.
CVE-2024-31816, published 2024-04-08. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getEasyWizardCfg.
CVE-2024-31807, published 2024-04-08. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the hostTime parameter in the NTPSyncWithHost function.
CVE-2024-7336, published 2024-08-01. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected by this vulnerability is the function loginauth of the file /cgi-bin/cstecgi.cgi. The manipulation…
CVE-2024-7335, published 2024-08-01. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in TOTOLINK EX200 4.0.3c.7646_B20201211. Affected is the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The…
CVE-2024-31809, published 2024-04-08. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function.
CVE-2024-31811, published 2024-04-08. High severity, CVSS 8.0. EPSS: 1% chance of exploitation in the next 30 days. TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg function.

Latest

CVE-2024-31810, published 2024-05-14. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.
CVE-2024-32326, published 2024-04-18. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the key parameter in the setWiFiExtenderConfig function.
CVE-2024-32325, published 2024-04-18. Low severity, CVSS 2.4. EPSS: 0.5% chance of exploitation in the next 30 days. TOTOLINK EX200 V4.0.3c.7646_B20201211 contains a Cross-site scripting (XSS) vulnerability through the ssid parameter in the setWiFiExtenderConfig function.
CVE-2024-31815, published 2024-04-08. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. In TOTOLINK EX200 V4.0.3c.7314_B20191204, an attacker can obtain the configuration file without authorization through /cgi-bin/ExportSettings.sh