Totolink n200re Firmware vulnerabilities

21 CVEs affecting Totolink n200re Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-55895, published 2025-12-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-19825, published 2020-01-27. Critical severity, CVSS 9.8. EPSS: 29.6% chance of exploitation in the next 30 days. On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA bypass. (Also, the…
CVE-2019-19824, published 2020-01-27. High severity, CVSS 8.8. EPSS: 25.1% chance of exploitation in the next 30 days. On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI (syscmd.htm) is not…
CVE-2019-19822, published 2020-01-27. High severity, CVSS 7.5. EPSS: 8.7% chance of exploitation in the next 30 days. A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data (usernames and…
CVE-2019-19823, published 2020-01-27. High severity, CVSS 7.5. EPSS: 6.4% chance of exploitation in the next 30 days. A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file. This affects TOTOLINK…
CVE-2024-0299, published 2024-01-08. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. Affected by this vulnerability is the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi.…
CVE-2024-0298, published 2024-01-08. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. Affected is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of…
CVE-2024-0297, published 2024-01-08. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This issue affects the function UploadFirmwareFile of the file /cgi-bin/cstecgi.cgi. The manipulation of…
CVE-2024-0296, published 2024-01-08. Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days. A vulnerability has been found in Totolink N200RE 9.3.5u.6139_B20201216 and classified as critical. This vulnerability affects the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The…
CVE-2025-7154, published 2025-07-08. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216. Affected by this issue is the function sub_41A0F8 of the file…
CVE-2024-0999, published 2024-01-29. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The…

Latest

CVE-2025-55895, published 2025-12-15. Critical severity, CVSS 9.1. EPSS: 0.3% chance of exploitation in the next 30 days. TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can send payloads to the interface without…
CVE-2025-55893, published 2025-12-15. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName.
CVE-2024-1004, published 2024-01-29. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in Totolink N200RE 9.3.5u.6139_B20201216. This affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the…
CVE-2024-1003, published 2024-01-29. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this issue is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The…
CVE-2024-1002, published 2024-01-29. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in Totolink N200RE 9.3.5u.6139_B20201216. Affected by this vulnerability is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The…
CVE-2024-1001, published 2024-01-29. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in Totolink N200RE 9.3.5u.6139_B20201216. Affected is the function main of the file /cgi-bin/cstecgi.cgi. The manipulation leads to stack-based…
CVE-2024-1000, published 2024-01-29. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been rated as critical. This issue affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation…
CVE-2024-0998, published 2024-01-29. High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N200RE 9.3.5u.6139_B20201216. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of…