Totolink n600r Firmware vulnerabilities

38 CVEs affecting Totolink n600r Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-60336, published 2025-10-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-26187, published 2022-03-22. Critical severity, CVSS 9.8. EPSS: 19.6% chance of exploitation in the next 30 days. TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
CVE-2022-26186, published 2022-03-22. Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days. TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.
CVE-2022-26189, published 2022-03-22. Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days. TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.
CVE-2022-26188, published 2022-03-22. Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days. TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.
CVE-2022-28906, published 2022-05-10. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.
CVE-2025-9935, published 2025-09-04. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead…
CVE-2022-28913, published 2022-05-10. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.
CVE-2022-28912, published 2022-05-10. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.
CVE-2022-28911, published 2022-05-10. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate.
CVE-2022-28910, published 2022-05-10. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName.

Latest

CVE-2025-60336, published 2025-10-22. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A NULL pointer dereference in the sub_41773C function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVE-2025-60335, published 2025-10-22. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. A NULL pointer dereference in the main function of TOTOLINK N600R v4.3.0cu.7866_B20220506 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVE-2025-60334, published 2025-10-22. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the ssid parameter in the setWiFiBasicConfig function. This vulnerability allows attackers to cause a Denial of…
CVE-2025-60333, published 2025-10-22. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. TOTOLINK N600R v4.3.0cu.7866_B20220506 was discovered to contain a stack overflow in the wepkey2 parameter in the setWiFiMultipleConfig function. This vulnerability allows attackers to cause a Denial…
CVE-2025-11444, published 2025-10-08. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request…
CVE-2025-57623, published 2025-09-25. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A NULL pointer dereference in TOTOLINK N600R firmware v4.3.0cu.7866_B2022506 allows attackers to cause a Denial of Service.
CVE-2025-51390, published 2025-08-04. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.
CVE-2025-8181, published 2025-07-26. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the component FTP Service. The manipulation…
CVE-2025-46060, published 2025-06-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component