TOTOLINK A7000R vulnerabilities

In TOTOLINK A7000R firmware version 9.1.0u.6115_B20201022, a vulnerability allows login bypass. An attacker can send a crafted request to formLoginAuth.htm to gain unauthorized access.

An access control issue was discovered in the TOTOLINK A7000R router running firmware version V4.1cu.4134, specifically in the /cgi-bin/ExportSettings.sh script. Lack of proper authentication allows unauthorized access to export device settings.

Totolink A7000R v9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the wifiOff parameter in the sub_421A04 function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.