CVE-2025-4269

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-266 CWE-284

Affected software

Vendor	Product	Versions
TOTOLINK	A720R	4.1.5cu.374

References

https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearDiagnosisLog.mdExploit
https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearSyslog.mdExploit
https://vuldb.com/?ctiid.307373Permissions Required, VDB Entry
https://vuldb.com/?id.307373Third Party Advisory, VDB Entry
https://vuldb.com/?submit.563430Third Party Advisory, VDB Entry
https://www.totolink.net/Product

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-42707.5A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file CVE-2025-427015.6A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to CVE-2025-427066.5A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to del CVE-2025-42715.3A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown f CVE-2025-42727.0A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functi CVE-2025-42757.8A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to byp CVE-2025-42767.5UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.CVE-2025-42777.5Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.CVE-2025-42788.7An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injectio CVE-2025-42798.8The External image replace plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'external CVE-2025-42804.8MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the u CVE-2025-42814.3A vulnerability, which was classified as problematic, was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 7