CVE-2025-5903

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
TOTOLINK	T10	4.1.8cu.5207

References

https://candle-throne-f75.notion.site/TOTOLINK-T10-setWiFiAclRules-20bdf0aa118580399a8df6ba2a44c197Exploit, Third Party Advisory
https://vuldb.com/?ctiid.311676Permissions Required, VDB Entry
https://vuldb.com/?id.311676Third Party Advisory, VDB Entry
https://vuldb.com/?submit.592247Third Party Advisory, VDB Entry
https://www.totolink.net/Product
https://candle-throne-f75.notion.site/TOTOLINK-T10-setWiFiAclRules-20bdf0aa118580399a8df6ba2a44c197Exploit, Third Party Advisory

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590307.5An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.CVE-2025-590314.3Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use CVE-2025-590327.5ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeated CVE-2025-590337.4The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only t CVE-2025-590344.3Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a l CVE-2025-590355.4Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, the CVE-2025-590365.5Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic CVE-2025-590378.6DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was comp CVE-2025-590388.6Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been bri CVE-2025-590399.3Prebid Universal Creative (PUC) is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected CVE-2025-59048.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function set CVE-2025-590404.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify