Vendor
TOTOLINK vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 192 vulnerabilities in TOTOLINK: 9 in the last 7 days and 80 in the last 90 days, 110 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124060, was published on 7 November 2026. 51 vulnerabilities in the last four weeks, up 155% on the four before (20). 50 critical against 14. 26 technologies have a page of their own.
- Last 7 days
- 9
- Last 90 days
- 80
- Critical, all time
- 110
- Exploited in the wild
- 0
About TOTOLINK
TOTOLINK is a manufacturer of network communication products including routers, switches, and wireless adapters.
TOTOLINK technologies
- TOTOLINK X2000r31
- TOTOLINK A3300R30
- TOTOLINK A3300r Firmware29
- TOTOLINK A8000RU27
- TOTOLINK A950RG14
- TOTOLINK A3002MU13
- TOTOLINK CA300-PoE9
- TOTOLINK CA750-PoE9
- TOTOLINK A7100RU8
- TOTOLINK NR1800X6
- TOTOLINK X5000R6
- TOTOLINK A720R5
- TOTOLINK A720R firmware4
- TOTOLINK EX2004
- TOTOLINK LR1200GB4
- TOTOLINK LR1200GB firmware4
- TOTOLINK N150RT4
- TOTOLINK N600R4
- TOTOLINK A950RG Firmware3
- TOTOLINK CP4503
- TOTOLINK EX1200L3
- TOTOLINK Lr3503
- TOTOLINK Lr350 Firmware3
- TOTOLINK N200RE firmware3
- TOTOLINK NR1800X firmware3
- TOTOLINK X5000R firmware3
Latest TOTOLINK vulnerabilities
- CVE-2026-124060: TOTOLINK CA300-PoE buffer overflow in UploadCustomModulecriticalCVSS 9.1
- CVE-2026-124059: TOTOLINK CA300-PoE buffer overflow in WiFi configurationcriticalCVSS 9.1
- CVE-2026-124058: TOTOLINK CA300-PoE buffer overflow in WiFi repeater configurationcriticalCVSS 9.1
- CVE-2026-124057: TOTOLINK CA300-PoE buffer overflow in setWiFiMultipleConfigcriticalCVSS 9.1
- CVE-2026-123961: TOTOLINK CA300-PoE buffer overflow in setWiFiBasicConfigcriticalCVSS 9.9
- CVE-2026-123960: TOTOLINK CA300-PoE buffer overflow in setWanConfigcriticalCVSS 9.9
- CVE-2026-123959: TOTOLINK CA300-PoE buffer overflow in setLanguageCfgcriticalCVSS 9.1
- CVE-2026-123958: TOTOLINK CA300-PoE buffer overflow in setLanConfigcriticalCVSS 9.9
- CVE-2026-123957: TOTOLINK CA300-PoE buffer overflow in setIpQosRulescriticalCVSS 9.9
- CVE-2026-121600: TOTOLINK A950RG stack buffer overflow in MAC filter handlercriticalCVSS 9.9
- CVE-2026-121599: TOTOLINK A950RG stack buffer overflow in WiFi configurationcriticalCVSS 9.9
- CVE-2026-121598: TOTOLINK A950RG stack buffer overflow in wireless configurationcriticalCVSS 9.9
- CVE-2026-121597: TOTOLINK A950RG stack buffer overflow in Easy Setup WizardcriticalCVSS 9.9
- CVE-2026-116508: TOTOLINK A950RG stack buffer overflow in infostat.cgicriticalCVSS 10
- CVE-2026-116507: TOTOLINK A950RG information disclosure in getLanguageCfgmediumCVSS 5.3
- CVE-2026-116506: TOTOLINK A950RG command injection in firewall.socriticalCVSS 9.9
- CVE-2026-116505: TOTOLINK A950RG command injection in device-information handlercriticalCVSS 9.1
- CVE-2026-116504: TOTOLINK A950RG command injection in cloud upgradecriticalCVSS 9.9
- CVE-2026-114575: TOTOLINK A950RG command injection in UploadCustomModulecriticalCVSS 10
- CVE-2026-114383: TOTOLINK EX200 stack-based buffer overflow in setWiFiAclAddConfigcriticalCVSS 10
- CVE-2026-114382: TOTOLINK EX200 stack buffer overflow in setStaticDhcpConfigcriticalCVSS 10
- CVE-2026-9869: TOTOLINK X2000R stack-based buffer overflow in formTR069ConfigcriticalCVSS 9.1
- CVE-2026-9827: Totolink X2000R arbitrary file write in boa formUploadFilecriticalCVSS 9.1
- CVE-2026-9817: Totolink X2000R stack-based buffer overflow in boa formUploadFilecriticalCVSS 9.1
- CVE-2026-9814: Totolink X2000R OS command injection in formWizardcriticalCVSS 9.1
Most severe TOTOLINK vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-105285: Totolink A3002MU stack buffer overflow in QoS handlercriticalCVSS 10EPSS 1.1%
- CVE-2026-79911: TOTOLINK N600R stack-based buffer overflow in setSystemConfigcriticalCVSS 10EPSS 1.1%
- CVE-2026-93740: Totolink A3002MU buffer overflow in formWlEncryptcriticalCVSS 10EPSS 0.9%
- CVE-2026-105284: Totolink A3002MU authentication bypass in bin/boacriticalCVSS 10EPSS 0.8%
- CVE-2026-93741: Totolink A3002MU buffer overflow in formWlWdscriticalCVSS 10EPSS 0.7%
- CVE-2026-116508: TOTOLINK A950RG stack buffer overflow in infostat.cgicriticalCVSS 10
- CVE-2026-114575: TOTOLINK A950RG command injection in UploadCustomModulecriticalCVSS 10
- CVE-2026-114383: TOTOLINK EX200 stack-based buffer overflow in setWiFiAclAddConfigcriticalCVSS 10
- CVE-2026-114382: TOTOLINK EX200 stack buffer overflow in setStaticDhcpConfigcriticalCVSS 10
- CVE-2026-105484: TOTOLINK X6000R OS command injection in firmware uploadcriticalCVSS 10
Vulnerabilities per week
51 vulnerabilities in the last four weeks, up 155% on the four before (20). 50 critical against 14. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 2 | 0 | |
| 24 Aug 2026 | 4 | 2 | |
| 31 Aug 2026 | 3 | 2 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 12 | 10 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 4 | 1 | |
| 5 Oct 2026 | 4 | 3 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 33 | 33 | |
| 26 Oct 2026 | 5 | 4 | |
| 2 Nov 2026 | 13 | 13 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many TOTOLINK vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/totolink)<a href="https://junglewise.ai/threats/vendors/totolink"><img src="https://junglewise.ai/threats/vendors/totolink/badge.svg" alt="TOTOLINK vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/totolink.json, and this page as text at https://junglewise.ai/threats/vendors/totolink.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "TOTOLINK vulnerabilities", https://junglewise.ai/threats/vendors/totolink, 13 November 2026.