PT-2025-19350 · Totolink · Totolink A720R

153528990

·

Published

2025-05-05

·

Updated

2025-05-05

·

CVE-2025-4270

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions TOTOLINK A720R version 4.1.5cu.374
Description A vulnerability was found in the Config Handler component of the TOTOLINK A720R, affecting an unknown function of the file /cgi-bin/cstecgi.cgi. The manipulation of the topicurl argument with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Recommendations As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file until a patch is available. Avoid using the topicurl argument with the input getInitCfg/getSysStatusCfg in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284CWE-200

Related Identifiers

BDU:2025-05811
CVE-2025-4270

Affected Products

Totolink A720R