CVE-2015-9550

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-11-24 · updated 2026-06-17
Weakness: CWE-668

Description

An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. By sending a specific hel,xasf packet to the WAN interface, it is possible to open the web management interface on the WAN interface.

Affected products

TOTOLINK A850R-V1 Firmware: before 1.0.1-b20150707.1612 — fixed in 1.0.1-b20150707.1612
TOTOLINK F1-V2 Firmware: before 2.1.1-b20150708.1646 — fixed in 2.1.1-b20150708.1646
TOTOLINK F2-V1 Firmware: before 2.1.0-b20150320.1611 — fixed in 2.1.0-b20150320.1611
TOTOLINK N150Rt-V2 Firmware: before 2.1.1-b20150708.1548 — fixed in 2.1.1-b20150708.1548
TOTOLINK N151Rt-V2 Firmware: before 1.1-b20150708.1559 — fixed in 1.1-b20150708.1559
TOTOLINK N300Rh-V2 Firmware: before 2.0.1-b20150708.1625 — fixed in 2.0.1-b20150708.1625
TOTOLINK N300Rh-V3 Firmware: before 3.0.0-b20150331.0858 — fixed in 3.0.0-b20150331.0858
TOTOLINK N300Rt-V2 Firmware: before 2.1.1-b20150708.1613 — fixed in 2.1.1-b20150708.1613

How to fix

Upgrade to a fixed version: TOTOLINK A850R-V1 Firmware 1.0.1-b20150707.1612; TOTOLINK F1-V2 Firmware 2.1.1-b20150708.1646; TOTOLINK F2-V1 Firmware 2.1.0-b20150320.1611; TOTOLINK N150Rt-V2 Firmware 2.1.1-b20150708.1548; TOTOLINK N151Rt-V2 Firmware 1.1-b20150708.1559; TOTOLINK N300Rh-V2 Firmware 2.0.1-b20150708.1625; TOTOLINK N300Rh-V3 Firmware 3.0.0-b20150331.0858; TOTOLINK N300Rt-V2 Firmware 2.1.1-b20150708.1613. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2015-9550 or the next vulnerability affects your stack