CVE-2023-7222

A vulnerability was found in Totolink X2000R 1.0.0-B20221212.1452. It has been declared as critical. This vulnerability affects the function formTmultiAP of the file /bin/boa of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249856. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-120
• CWE-787

• https://github.com/jylsec/vuldb/blob/main/TOTOLINK/X2000R/formTmultiAP/README.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.249856Permissions Required, Third Party Advisory
• https://vuldb.com/?id.249856Permissions Required, Third Party Advisory
• https://github.com/jylsec/vuldb/blob/main/TOTOLINK/X2000R/formTmultiAP/README.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.249856Permissions Required, Third Party Advisory
• https://vuldb.com/?id.249856Permissions Required, Third Party Advisory

Published

Jan 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-7215A vulnerability, which was classified as problematic, has be…6.1
• CVE-2023-7216A path traversal vulnerability was found in the CPIO utility…5.3
• CVE-2023-7218A vulnerability, which was classified as critical, was found…7.2
• CVE-2023-7219A vulnerability has been found in Totolink N350RT 9.3.5u.613…9.8
• CVE-2023-7220A vulnerability was found in Totolink NR1800X 9.1.0u.6279_B2…9.8
• CVE-2023-7221A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210…9.8
• CVE-2023-7223A vulnerability classified as problematic has been found in …6.5
• CVE-2023-7224OpenVPN Connect version 3.0 through 3.4.6 on macOS allows lo…7.8
• CVE-2023-7225The MapPress Maps for WordPress plugin for WordPress is vuln…5.4
• CVE-2023-7226A vulnerability was found in meetyoucrop big-whale 1.1 and c…6.5
• CVE-2023-7227 SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior…9.8
• CVE-2023-7228The illi Link Party! WordPress plugin through 1.0 does not s…6.1