Totolink n350rt Firmware vulnerabilities

21 CVEs affecting Totolink n350rt Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-51630, published 2025-07-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-7462, published 2024-08-05. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in TOTOLINK N350RT 9.3.5u.6139_B20201216. This affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the…
CVE-2023-7219, published 2024-01-09. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability has been found in Totolink N350RT 9.3.5u.6139_B202012 and classified as critical. Affected by this vulnerability is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The…
CVE-2023-7218, published 2024-01-08. High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in Totolink N350RT 9.3.5u.6139_B202012. Affected is the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the…
CVE-2022-36481, published 2022-08-25. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the ip parameter in the function setDiagnosisCfg.
CVE-2024-7333, published 2024-08-01. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK N350RT 9.3.5u.6139_B20201216. It has been declared as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The…
CVE-2022-36487, published 2022-08-25. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the command parameter in the function setTracerouteCfg.
CVE-2022-36486, published 2022-08-25. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the FileName parameter in the function UploadFirmwareFile.
CVE-2022-36485, published 2022-08-25. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg.
CVE-2022-36479, published 2022-08-25. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the host_time parameter in the function NTPSyncWithHost.
CVE-2022-36482, published 2022-08-25. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a command injection vulnerability via the lang parameter in the function setLanguageCfg.

Latest

CVE-2025-51630, published 2025-07-17. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. TOTOLINK N350RT V9.3.5u.6139_B20201216 was discovered to contain a buffer overflow via the ePort parameter in the function setIpPortFilterRules.
CVE-2024-42966, published 2024-08-15. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to…
CVE-2024-0943, published 2024-01-26. Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was found in Totolink N350RT 9.3.5u.6255. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The…
CVE-2024-0570, published 2024-01-16. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6265. This vulnerability affects unknown code of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The…
CVE-2023-7214, published 2024-01-07. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login…
CVE-2023-7213, published 2024-01-07. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in Totolink N350RT 9.3.5u.6139_B20201216. Affected by this vulnerability is the function main of the file /cgi-bin/cstecgi.cgi?action=login&flag=1 of…