Totolink t10 Firmware vulnerabilities

22 CVEs affecting Totolink t10 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-14964, published 2025-12-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-5905, published 2025-06-10. High severity, CVSS 8.8. EPSS: 11.5% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been rated as critical. Affected by this issue is the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi of the component POST…
CVE-2025-5904, published 2025-06-10. High severity, CVSS 8.8. EPSS: 11.3% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the…
CVE-2025-5903, published 2025-06-10. High severity, CVSS 8.8. EPSS: 11.3% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request…
CVE-2025-9533, published 2025-08-27. Critical severity, CVSS 9.8. EPSS: 10.8% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK T10 4.1.8cu.5241_B20210927. Affected is an unknown function of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads…
CVE-2025-5901, published 2025-06-09. High severity, CVSS 8.8. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component…
CVE-2025-5902, published 2025-06-09. High severity, CVSS 8.8. EPSS: 6.1% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler.…
CVE-2024-9001, published 2024-09-19. High severity, CVSS 8.8. EPSS: 3.3% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation…
CVE-2022-25132, published 2022-02-19. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted…
CVE-2022-25137, published 2022-02-19. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows…
CVE-2022-25136, published 2022-02-19. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows…

Latest

CVE-2025-14964, published 2025-12-19. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to…
CVE-2025-44655, published 2025-07-21. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. In TOTOLink A7100RU V7.4, A950RG V5.9, and T10 V5.9, the chroot_local_user option is enabled in the vsftpd.conf. This could lead to unauthorized access to system files, privilege escalation, or use…
CVE-2025-6139, published 2025-06-16. Low severity, CVSS 3.9. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The…
CVE-2025-6138, published 2025-06-16. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST…
CVE-2025-6137, published 2025-06-16. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request…