PT-2025-43896 · Totolink · Totolink A3300R

Wxhwxhwxh_Mie · Published 2025-10-12 · Updated 2025-10-27 · CVE-2025-12240

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version 17.0.0cu.557 B20221024

Description A security issue exists in TOTOLINK A3300R 17.0.0cu.557 B20221024. The setDmzCfg function within the /cgi-bin/cstecgi.cgi file is susceptible to a buffer overflow when the ip argument is manipulated. This allows for remote exploitation. The exploit for this issue has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

BDU:2025-13500

CVE-2025-12240

Affected Products

Totolink A3300R

References · 11

• 🔥 https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setDmzCfg.md · Exploit
• https://bdu.fstec.ru/vul/2025-13500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-12240 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12240 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1982867463646646462 · Twitter Post
• https://t.me/cveNotify/140405 · Telegram Post
• https://vuldb.com/?submit.673722 · Note
• https://vuldb.com/?ctiid.329910 · Note
• https://t.me/CVEtracker/35799 · Telegram Post
• https://vuldb.com/?id.329910 · Note
• https://totolink.net · Note