Deviceways

Router

TOTOLINK LR1200

Contribute

Projects for this device

Replacement firmware

Replace router software with a customizable system for network controls and community packages.

How to get started

Follow the guide for your exact router version. The first installation may use its web interface, recovery mode or a serial connection.

Setup
Firmware replacement; route varies by router
You’ll need
Exact hardware revision, an appropriate OpenWrt release and its model-specific installation guide.
Hardware revision not specified
Release listed · 25.12.6
Hardware revision not specified
Release listed · 25.12.5
Open hardware recordopenwrt.org
Original project github.com

Recorded configuration: 8 MB flash; 64 MB RAM

First installation
U-Boot web recovery
Sources

Features & details

Check the project and hardware shown for each feature.

OpenWrt

OpenWrt — Source documentation (openwrt.org)

Installation routes recorded
U-Boot web recovery
Recovery routes recorded
U-Boot web recovery

Hardware details

Technical references

Security

Saved scan

From our saved security research.

Model advisories

Selected highlights

Prioritized by known exploitation, severity, then date.

CVE published

CVSS 5.3 (v4.0)

LR1200

TOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injection

CVE-2024-7215

Affected firmware
9.3.1cu.2832
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832 and classified as critical. Affected by this issue is the function NTPSyncWithHost of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument host_time leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-272786 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

VDB-272786 | TOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injection — LR1200 (vuldb.com) ↗VDB-272786 | CTI Indicators (IOB, IOC, TTP, IOA) — LR1200 (vuldb.com) ↗Submit #378330 | TOTOLINK LR1200 V9.3.1cu.2832 Command Injection — LR1200 (vuldb.com) ↗
CVE published

CVSS 2.1 (v4.0)

LR1200

TOTOLINK LR1200 shadow.sample hard-coded password

CVE-2024-7216

Affected firmware
9.3.1cu.2832
Fix
Fix details in the linked record
Read VulDB CVE record
Details and sources
CVE updated

A vulnerability was found in TOTOLINK LR1200 9.3.1cu.2832. It has been classified as problematic. This affects an unknown part of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272787. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

VDB-272787 | TOTOLINK LR1200 shadow.sample hard-coded password — LR1200 (vuldb.com) ↗VDB-272787 | CTI Indicators (IOB, IOC, TTP, IOA) — LR1200 (vuldb.com) ↗Submit #378331 | TOTOLINK LR1200 V9.3.1cu.2832 Use of Hard-coded Password — LR1200 (vuldb.com) ↗
Check more security advisories for this device · CVE.org