PT-2025-24578 · Totolink · Totolink T10

Ysnysnysn

·

Published

2025-06-07

·

Updated

2025-06-16

·

CVE-2025-5903

CVSS v2.0
9.0
VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions TOTOLINK T10 version 4.1.8cu.5207
Description A critical issue has been found in the TOTOLINK T10, affecting the function 
setWiFiAclRules
of the file 
/cgi-bin/cstecgi.cgi
of the component POST Request Handler. The manipulation of the argument 
desc
leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Recommendations As a temporary workaround, consider disabling the 
setWiFiAclRules
function until a patch is available. Restrict access to the 
/cgi-bin/cstecgi.cgi
file to minimize the risk of exploitation. Avoid using the 
desc
argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-10023
CVE-2025-5903

Affected Products

Totolink T10