Details of VAR-202505-0066

ID

VAR-202505-0066

CVE

CVE-2025-4271

TITLE

TOTOLINK of A720R Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2025-004503

DESCRIPTION

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of A720R There are unspecified vulnerabilities in the firmware.Information may be obtained. TOTOLINK A720R is a wireless router from China's TOTOLINK Electronics. Attackers can exploit this vulnerability to cause information leakage

Trust: 2.16

sources: NVD: CVE-2025-4271 // JVNDB: JVNDB-2025-004503 // CNVD: CNVD-2025-12877

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2025-12877

AFFECTED PRODUCTS

vendor:	totolink	model:	a720r	scope:	eq	version:	4.1.5cu.374	Trust: 1.0
vendor:	totolink	model:	a720r	scope:	eq	version:	a720r firmware 4.1.5cu.374	Trust: 0.8
vendor:	totolink	model:	a720r	scope:	eq	version:	-	Trust: 0.8
vendor:	totolink	model:	a720r	scope:	-	version:	-	Trust: 0.8
vendor:	totolink	model:	a720r 4.1.5cu.374	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2025-12877 // JVNDB: JVNDB-2025-004503 // NVD: CVE-2025-4271

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com:	CVE-2025-4271
value:	MEDIUM
Trust: 1.0
OTHER:	JVNDB-2025-004503
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2025-12877
value:	MEDIUM
Trust: 0.6

cna@vuldb.com:	CVE-2025-4271
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
OTHER:	JVNDB-2025-004503
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2025-12877
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

cna@vuldb.com:	CVE-2025-4271
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
OTHER:	JVNDB-2025-004503
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2025-12877 // JVNDB: JVNDB-2025-004503 // NVD: CVE-2025-4271

PROBLEMTYPE DATA

problemtype:	CWE-200	Trust: 1.0
problemtype:	CWE-284	Trust: 1.0
problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	information leak (CWE-200) [ others ]	Trust: 0.8
problemtype:	Inappropriate access control (CWE-284) [ others ]	Trust: 0.8
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2025-004503 // NVD: CVE-2025-4271

PATCH

title:

Patch for TOTOLINK A720R Information Disclosure Vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/699631

Trust: 0.6

sources: CNVD: CNVD-2025-12877

EXTERNAL IDS

db:	NVD	id:	CVE-2025-4271	Trust: 3.2
db:	VULDB	id:	307375	Trust: 1.8
db:	JVNDB	id:	JVNDB-2025-004503	Trust: 0.8
db:	CNVD	id:	CNVD-2025-12877	Trust: 0.6

sources: CNVD: CNVD-2025-12877 // JVNDB: JVNDB-2025-004503 // NVD: CVE-2025-4271

REFERENCES

url:	https://github.com/at0de/my_vulns/blob/main/totolink/a720r/showsyslog.md	Trust: 1.8
url:	https://vuldb.com/?id.307375	Trust: 1.8
url:	https://vuldb.com/?submit.563444	Trust: 1.8
url:	https://www.totolink.net/	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2025-4271	Trust: 1.4
url:	https://vuldb.com/?ctiid.307375	Trust: 1.0

sources: CNVD: CNVD-2025-12877 // JVNDB: JVNDB-2025-004503 // NVD: CVE-2025-4271

SOURCES

db:	CNVD	id:	CNVD-2025-12877
db:	JVNDB	id:	JVNDB-2025-004503
db:	NVD	id:	CVE-2025-4271

LAST UPDATE DATE

2025-06-21T23:21:23.572000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2025-12877	date:	2025-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2025-004503	date:	2025-05-08T08:05:00
db:	NVD	id:	CVE-2025-4271	date:	2025-05-07T16:38:36.743

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2025-12877	date:	2025-06-19T00:00:00
db:	JVNDB	id:	JVNDB-2025-004503	date:	2025-05-08T00:00:00
db:	NVD	id:	CVE-2025-4271	date:	2025-05-05T08:15:15.790