PT-2025-20607 · Totolink · Totolink T10+6

Babyshark · Published 2025-05-10 · Updated 2025-07-29 · CVE-2025-4496

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK T10 version 4.1.8cu.5241 B20210927 TOTOLINK A3100R version 4.1.8cu.5241 B20210927 TOTOLINK A950RG version 4.1.8cu.5241 B20210927 TOTOLINK A800R version 4.1.8cu.5241 B20210927 TOTOLINK N600R version 4.1.8cu.5241 B20210927 TOTOLINK A3000RU version 4.1.8cu.5241 B20210927 TOTOLINK A810R version 4.1.8cu.5241 B20210927

Description A critical vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2025-05813

CVE-2025-4496

Affected Products

Totolink A3000Ru

Totolink A3100R

Totolink A800R

Totolink A810R

Totolink A950Rg

Totolink N600R

Totolink T10

References · 21

• 🔥 https://github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/1.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-4496 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05813 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4496 · Security Note
• https://github.com/CH13hh/tmp_store_cc · Note
• https://twitter.com/cracbot/status/1922970283239145717 · Twitter Post
• https://t.me/latest_high_impact_cve/2320 · Telegram Post
• https://twitter.com/CVEnew/status/1921076094360342767 · Twitter Post
• https://t.me/true_secator/7211 · Telegram Post
• https://twitter.com/cybercronai/status/1921241616989176027 · Twitter Post
• https://vuldb.com/?exploit_url.308212 · Note
• https://totolink.net · Note
• https://t.me/cvenotify/121631 · Telegram Post
• https://twitter.com/cybercronai/status/1921212469919248535 · Twitter Post
• https://vuldb.com/?id.308212 · Note