CVE-2025-3674

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Apr 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-367436.8SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and exec CVE-2025-367442.4SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initialize CVE-2025-367457.8SolarEdge SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems. An attacker with network or CVE-2025-367465.4SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report na CVE-2025-367479.8ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP conn CVE-2025-367485.4ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can CVE-2025-36755.3A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function se CVE-2025-367505.4ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant CVE-2025-367519.4Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the net CVE-2025-367529.8Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level acce CVE-2025-367539.8The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access CVE-2025-367549.3The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post