PT-2025-24578 · Totolink · Totolink T10

Ysnysnysn

·

Published

2025-06-07

·

Updated

2025-06-16

·

CVE-2025-5903

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions TOTOLINK T10 version 4.1.8cu.5207
Description A critical issue has been found in the TOTOLINK T10, affecting the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Recommendations As a temporary workaround, consider disabling the setWiFiAclRules function until a patch is available. Restrict access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation. Avoid using the desc argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-10023
CVE-2025-5903

Affected Products

Totolink T10