by Kastro
Paper/Archive/CVE-2025-1852

CVE-2025-1852

Totolink EX1800T — Totolink EX1800T cstecgi.cgi loginAuth buffer overflow

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 58.9.589 × 2011.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability has been found in Totolink EX1800T 9.1.0cu.2112_B20220316 and classified as critical. This vulnerability affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
EX1800T9.1.0cu.2112_B20220316–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.298120refvuldb.com/?ctiid.298120writeupvuldb.com/?submit.505362exploitgithub.com/watermelon-happy/cve/blob/main/ex1800tCVE.mdreftotolink.net