Totolink n300rh-v3 Firmware vulnerabilities

3 CVEs affecting Totolink n300rh-v3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-25499, published 2020-12-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-9551, published 2020-11-24. Critical severity, CVSS 9.8. EPSS: 4.4% chance of exploitation in the next 30 days. An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Execution in the management interface via the formSysCmd…
CVE-2020-25499, published 2020-12-09. High severity, CVSS 8.8. EPSS: 4.2% chance of exploitation in the next 30 days. TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
CVE-2015-9550, published 2020-11-24. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. By sending a specific hel,xasf packet to the WAN interface, it is possible to…