CVE-2025-5904

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument device_name leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
TOTOLINK	T10	4.1.8cu.5207

References

https://candle-throne-f75.notion.site/TOTOLINK-T10-setWiFiMeshName-20bdf0aa1185806eb922dbd496c4a4b4Exploit, Third Party Advisory
https://vuldb.com/?ctiid.311677Permissions Required, VDB Entry
https://vuldb.com/?id.311677Third Party Advisory, VDB Entry
https://vuldb.com/?submit.592264Third Party Advisory, VDB Entry
https://www.totolink.net/Product
https://candle-throne-f75.notion.site/TOTOLINK-T10-setWiFiMeshName-20bdf0aa1185806eb922dbd496c4a4b4Exploit, Third Party Advisory

Timeline

Published: Jun 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590404.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify CVE-2025-590419.8Claude Code is an agentic coding tool. At startup, Claude Code executed a command templated in with `git config user.email`. Prior to versio CVE-2025-590427.0PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to `sys.path`CVE-2025-590437.5OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects after decoding may use CVE-2025-590444.4Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau 0.9.x derives numeric GIDs for Entra ID groups f CVE-2025-590457.1Stalwart is a mail and collaboration server. Starting in version 0.12.0 and prior to version 0.13.3, a memory exhaustion vulnerability exist CVE-2025-590469.8The npm package `interactive-git-checkout` is an interactive command-line tool that allows users to checkout a git branch while it prompts f CVE-2025-590472.7matrix-sdk-base is the base component to build a Matrix client library. In matrix-sdk-base before 0.14.1, calling the `RoomMember::normalize CVE-2025-590488.1OpenBao's AWS Plugin generates AWS access credentials based on IAM policies. Prior to version 0.1.1, the AWS Plugin is vulnerable to cross-a CVE-2025-590497.5Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same CVE-2025-59058.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been rated as critical. Affected by this issue is the function setWiFiRepeate CVE-2025-590507.8Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM