PT-2025-25586 · Totolink · Totolink T10

Ysnyhr

·

Published

2025-06-09

·

Updated

2025-06-26

·

CVE-2025-6137

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions TOTOLINK T10 version 4.1.8cu.5207
Description A critical vulnerability has been found in the setWiFiScheduleCfg function of the file /cgi-bin/cstecgi.cgi, which is part of the HTTP POST Request Handler component. The manipulation of the desc argument leads to a buffer overflow. This issue can be exploited remotely. The exploit has been disclosed to the public.
Recommendations For TOTOLINK T10 version 4.1.8cu.5207, as a temporary workaround, consider disabling the setWiFiScheduleCfg function until a patch is available. Restrict access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation. Avoid using the desc argument in the affected HTTP POST Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-07400
CVE-2025-6137

Affected Products

Totolink T10