PT-2025-20421 · Totolink+1 · Totolink A950Rg+1

Sunnyyangyaya · Published 2025-04-06 · Updated 2025-05-19 · CVE-2025-45798

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A950RG version 4.1.2cu.5204 B20210112

Description A command execution issue exists, located in the setNoticeCfg interface within the /lib/cste modules/system.so library, specifically in the processing of the IpTo parameter.

Recommendations For TOTOLINK A950RG version 4.1.2cu.5204 B20210112, as a temporary workaround, consider restricting access to the setNoticeCfg interface within the /lib/cste modules/system.so library to minimize the risk of exploitation. Avoid using the IpTo parameter in the affected interface until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-06199

CVE-2025-45798

Affected Products

Totolink A950Rg

System.So

References · 10

• 🔥 https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-setNoticeCFG-IpTo-command.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-45798 · Security Note
• https://bdu.fstec.ru/vul/2025-06199 · Security Note
• https://osv.dev/vulnerability/CVE-2025-45798 · Vendor Advisory
• https://twitter.com/dailycve/status/1924503159428309123 · Twitter Post
• https://t.me/cvedetector/24865 · Telegram Post
• https://t.me/cvenotify/122944 · Telegram Post
• https://t.me/cvenotify/121790 · Telegram Post
• https://t.me/cvetracker/23395 · Telegram Post
• https://twitter.com/CVEnew/status/1920595178345423157 · Twitter Post