Volerion logoVolerion
Volerion logoVolerion

Actively Exploited in the Wild

This vulnerability is being actively exploited in the wild.

TOTOLINK N200RE OS Command Injection Vulnerability

Vulnerability

A critical OS command injection vulnerability has been identified in the TOTOLINK N200RE router, specifically in versions 9.3.5u.6095_B20200916 and 9.3.5u.6139_B20201216. The vulnerability resides in the CGI script '/cgi-bin/cstecgi.cgi', within the function 'sub_41A0F8'. The issue arises from improper handling of the 'Hostname' parameter, allowing remote attackers to inject and execute arbitrary OS commands.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution on the affected device.

Added: Jul 8, 2025, 1:18 AM
Updated: Jul 8, 2025, 1:18 AM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
10.0
exploitability
6.6
remediation
0.0
relevance
0.2
threat
8.1
urgency
2.9
incentive
0.8

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.