PT-2025-6379 · Totolink · Totolink X6000R

Published 2025-02-11 · Updated 2025-02-11 · CVE-2025-25524

Positive Technologies (AI Summary)

CVSS v3.1

5.1

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TOTOLink X6000R version V9.4.0cu.652 B20230116

Description The issue is related to a buffer overflow vulnerability due to the lack of length verification when adding Wi-Fi filtering rules. This can cause the remote target device to crash or execute arbitrary commands.

Recommendations For version V9.4.0cu.652 B20230116, consider disabling the Wi-Fi filtering rule addition feature until a patch is available to prevent potential exploitation. Restrict access to the vulnerable Wi-Fi rule handling module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-05795

CVE-2025-25524

Affected Products

Totolink X6000R

References · 7

• https://osv.dev/vulnerability/CVE-2025-25524 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05795 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-25524 · Security Note
• https://t.me/cvedetector/17732 · Telegram Post
• https://gist.github.com/XiaoCurry/ce1f80afd2d8be8ca543437f16eae96b · Note
• https://twitter.com/VulmonFeeds/status/1889399205732536428 · Twitter Post
• https://twitter.com/CVEnew/status/1889394885985247419 · Twitter Post