Totolink EX300 v2 Firmware vulnerabilities

6 CVEs affecting Totolink EX300 v2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-32449, published 2022-07-07.

More from Totolink.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-32449, published 2022-07-07. Critical severity, CVSS 9.8. EPSS: 19.4% chance of exploitation in the next 30 days. TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vulnerability is exploitable via a crafted…
• CVE-2022-25008, published 2022-03-30. High severity, CVSS 8.8. EPSS: 4.4% chance of exploitation in the next 30 days. totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.
• CVE-2021-43664, published 2022-03-30. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo.
• CVE-2021-43663, published 2022-03-31. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check.
• CVE-2021-43661, published 2022-03-31. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.
• CVE-2021-43662, published 2022-03-31. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption.