by Kastro
Paper/Archive/CVE-2025-4496

CVE-2025-4496

TOTOLINK T10 — TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
53
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 69.0.690 × 2013.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was found in TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R 4.1.8cu.5241_B20210927. It has been declared as critical. This vulnerability affects the function CloudACMunualUpdate of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

ProductAffectedFixed inSource
T104.1.8cu.5241_B20210927–CNA
A3100R4.1.8cu.5241_B20210927–CNA
A950RG4.1.8cu.5241_B20210927–CNA
A800R4.1.8cu.5241_B20210927–CNA
N600R4.1.8cu.5241_B20210927–CNA
A3000RU4.1.8cu.5241_B20210927–CNA
A810R4.1.8cu.5241_B20210927–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
VulDB (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.308212refvuldb.com/?ctiid.308212writeupvuldb.com/?submit.567081exploitgithub.com/CH13hh/tmp_store_cc/blob/main/tt/ta/1.mdreftotolink.net