CVE-2025-9303

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument desc results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
TOTOLINK	A720R	4.1.5cu.630_B20250509

References

https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.mdExploit, Third Party Advisory
https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.320908Permissions Required, VDB Entry
https://vuldb.com/?id.320908Third Party Advisory, VDB Entry
https://vuldb.com/?submit.632410Third Party Advisory, VDB Entry
https://www.totolink.net/Third Party Advisory, VDB Entry

Timeline

Published: Aug 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-93049.8A weakness has been identified in SourceCodester Online Bank Management System 1.0. Impacted is an unknown function of the file /bank/show.p CVE-2025-93059.8A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. The affected element is an unknown function CVE-2025-93065.4A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the fil CVE-2025-93079.8A flaw has been found in PHPGurukul Online Course Registration 3.1. This affects an unknown function of the file /admin/session.php. This ma CVE-2025-93085.5A vulnerability has been found in yarnpkg Yarn up to 1.22.22. This impacts the function setOptions of the file src/util/request-manager.js. CVE-2025-93097.0A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Ha CVE-2025-93107.5A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unkn CVE-2025-93119.8A vulnerability was identified in itsourcecode Apartment Management System 1.0. Affected by this issue is some unknown functionality of the CVE-2025-93129.8A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services CVE-2025-93139.3An unauthenticated user can connect to a publicly accessible database using arbitrary credentials. The system grants full access to the data CVE-2025-93149.8The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload CVE-2025-93156.3An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attribut