PT-2025-19346 · Totolink · Totolink A720R

153528990

·

Published

2025-04-22

·

Updated

2025-05-05

·

CVE-2025-4269

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:N/I:P/A:P
Name of the Vulnerable Software and Affected Versions TOTOLINK A720R version 4.1.5cu.374
Description A critical issue affects the Log Handler component of TOTOLINK A720R, specifically the file /cgi-bin/cstecgi.cgi. The manipulation of the topicurl argument with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Recommendations As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file until a patch is available. Avoid using the topicurl argument with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284CWE-266

Related Identifiers

BDU:2025-05387
CVE-2025-4269

Affected Products

Totolink A720R