AF
Product
A3002ru Firmware
49
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 29Medium 9Low 2
Watch
Add A3002ru Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-34198 | 9.8 | Aug 28 | TOTOLINK AC1200 Wireless Router A3002RU V2.1.1-B20230720.1011 is vulnerable to Buffer Overflow Affected: 2.1.1-b20230720.1011 |
| CVE-2022-35491 | 9.8 | Aug 9 | TOTOLINK A3002RU V3.0.0-B20220304.1804 has a hardcoded password for root in /etc/shadow.sample Affected: 3.0.0-b20220304.1804 |
| CVE-2019-19825 | 9.8 | Jan 27 | On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via an {"topicurl":"setting/getSanvas"} POST to the boafrm/formLogin URI, leading to a CAPTCHA… Affected: through 2.0.0 |
| CVE-2018-13316 | 9.8 | Nov 27 | System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter Affected: 1.0.8 |
| CVE-2018-13314 | 9.8 | Nov 27 | System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter Affected: 1.0.8 |
| CVE-2018-13307 | 9.8 | Nov 27 | System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter Affected: 1.0.8 |
| CVE-2018-13306 | 9.8 | Nov 27 | System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter Affected: 1.0.8 |
| CVE-2018-13315 | 9.8 | Nov 26 | Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin user's password via an unauthenticated POST request Affected: 1.0.8 |
| CVE-2018-13311 | 9.8 | Nov 26 | System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter Affected: 1.0.8 |
| CVE-2026-26732 | 8.8 | Feb 17 | TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter function Affected: 2.1.1-b20211108.1455 |
| CVE-2026-26731 | 8.8 | Feb 17 | TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function Affected: 2.1.1-b20211108.1455 |
| CVE-2026-26736 | 8.8 | Feb 17 | TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function Affected: through 3.0.0-b20220304.1804 |
| CVE-2025-6953 | 8.8 | Jul 1 | A vulnerability, which was classified as critical, was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-6939 | 8.8 | Jul 1 | A vulnerability classified as critical has been found in TOTOLINK A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-6337 | 8.8 | Jun 20 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615/4.0.0-B20230531.1404 Affected: 3.0.0-b20230809.1615; 4.0.0-b20230531.1404 |
| CVE-2025-6163 | 8.8 | Jun 17 | A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 and classified as critical Affected: 3.0.0-b20230809.1615 |
| CVE-2025-6148 | 8.8 | Jun 17 | A vulnerability was found in TOTOLINK A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4835 | 8.8 | May 17 | A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4834 | 8.8 | May 17 | A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4833 | 8.8 | May 17 | A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4832 | 8.8 | May 17 | A vulnerability has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 and classified as critical Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4831 | 8.8 | May 17 | A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4830 | 8.8 | May 17 | A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4829 | 8.8 | May 17 | A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4827 | 8.8 | May 17 | A vulnerability, which was classified as critical, was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4826 | 8.8 | May 17 | A vulnerability, which was classified as critical, has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4825 | 8.8 | May 17 | A vulnerability classified as critical was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4824 | 8.8 | May 17 | A vulnerability classified as critical has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4823 | 8.8 | May 17 | A vulnerability was found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4733 | 8.8 | May 16 | A vulnerability, which was classified as critical, has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4732 | 8.8 | May 16 | A vulnerability classified as critical was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4731 | 8.8 | May 16 | A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2025-4730 | 8.8 | May 16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2023-48859 | 8.8 | Dec 6 | TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute… Affected: 2.0.0-b20190902.1958 |
| CVE-2019-19824 | 8.8 | Jan 27 | On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI… Affected: through 2.0.0 |
| CVE-2025-6393 | 7.5 | Jun 21 | A vulnerability was found in TOTOLINK A702R, A3002R, A3002RU and EX1200T 3.0.0-B20230809.1615/4.0.0-B20230531.1404/4.0.0-B20230721.1521/4.1.2cu.5232_B20210713 Affected: 3.0.0-b20230809.1615 |
| CVE-2019-19823 | 7.5 | Jan 27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) stores cleartext administrative passwords in flash memory and in a file Affected: through 2.0.0 |
| CVE-2019-19822 | 7.5 | Jan 27 | A certain router administration interface (that includes Realtek APMIB 0.11f for Boa 0.94.14rc21) allows remote attackers to retrieve the configuration, including sensitive data… Affected: through 2.0.0 |
| CVE-2018-13313 | 6.5 | Feb 24 | In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password Affected: 1.0.8 |
| CVE-2025-4729 | 6.3 | May 16 | A vulnerability was found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615 Affected: 3.0.0-b20230809.1615 |
| CVE-2018-13317 | 6.1 | Nov 26 | Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm Affected: 1.0.8 |
| CVE-2018-13312 | 6.1 | Nov 26 | Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field Affected: 1.0.8 |
| CVE-2018-13310 | 6.1 | Nov 26 | Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username Affected: 1.0.8 |
| CVE-2018-13309 | 6.1 | Nov 26 | Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password Affected: 1.0.8 |
| CVE-2018-13308 | 6.1 | Nov 26 | Cross-site scripting in notice_gen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field Affected: 1.0.8 |
| CVE-2025-5507 | 5.4 | Jun 3 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 Affected: 2.1.1-b20230720.1011 |
| CVE-2025-5506 | 5.4 | Jun 3 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 Affected: 2.1.1-b20230720.1011 |
| CVE-2025-5508 | 3.4 | Jun 3 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 Affected: 2.1.1-b20230720.1011 |
| CVE-2025-5505 | 2.4 | Jun 3 | A vulnerability was found in TOTOLINK A3002RU 2.1.1-B20230720.1011 and classified as problematic Affected: 2.1.1-b20230720.1011 |
Showing 49