PT-2025-25589 · Totolink · Totolink T10

Ysnlrh

·

Published

2025-06-09

·

Updated

2025-06-17

·

CVE-2025-6138

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions TOTOLINK T10 version 4.1.8cu.5207
Description A critical vulnerability was found in the TOTOLINK T10, affecting the function setWizardCfg of the file /cgi-bin/cstecgi.cgi in the HTTP POST Request Handler component. The manipulation of the argument ssid5g leads to a buffer overflow. This issue can be exploited remotely.
Recommendations For TOTOLINK T10 version 4.1.8cu.5207, consider disabling the setWizardCfg function until a patch is available to prevent remote buffer overflow via manipulation of the ssid5g argument. Restrict access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation. Avoid using the ssid5g argument in the affected HTTP POST Request Handler until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119CWE-120

Related Identifiers

BDU:2025-06925
CVE-2025-6138

Affected Products

Totolink T10