CVE-2022-32993
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
An access control issue was discovered in the TOTOLINK A7000R router running firmware version V4.1cu.4134, specifically in the /cgi-bin/ExportSettings.sh script. Lack of proper authentication allows unauthorized access to export device settings.
Risk Assessment
Unauthorized access to export settings could allow an attacker to download sensitive configuration data, including passwords and keys, leading to full compromise of the router and network.
Recommendation
Immediately update the TOTOLINK A7000R firmware to the latest available version, or apply temporary mitigations such as restricting administrative access to trusted IP addresses only.
Other vulnerabilities in TOTOLINK A7000R
See all- CVE-2025-51452Critical
In TOTOLINK A7000R firmware version 9.1.0u.6115_B20201022, a vulnerability allows login bypass. An attacker can send a crafted request to formLoginAuth.htm to gain unauthorized access.
- CVE-2025-63462High
Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
Original NVD description (English source)
TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS