Totolink · Totolink T10 · CVE-2025-5904
**Name of the Vulnerable Software and Affected Versions**
TOTOLINK T10 version 4.1.8cu.5207
**Description**
A critical vulnerability was found in the TOTOLINK T10, affecting the function `setWiFiMeshName` of the file `/cgi-bin/cstecgi.cgi` in the component POST Request Handler. The manipulation of the argument `device name` leads to a buffer overflow. This attack can be launched remotely, and the exploit has been disclosed to the public.
**Recommendations**
As a temporary workaround, consider disabling the `setWiFiMeshName` function until a patch is available. Restrict access to the `/cgi-bin/cstecgi.cgi` file to minimize the risk of exploitation. Avoid using the `device name` argument in the affected POST Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.