Sign-up

ID

VAR-202506-0428


CVE

CVE-2025-5903


TITLE

TOTOLINK  of  t10  Classic buffer overflow vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-007041

DESCRIPTION

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. TOTOLINK of t10 Firmware has a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TOTOLINK T10 is a dual-band Mesh networking router produced by TOTOLINK, suitable for full coverage of home and office networks. The vulnerability is caused by the incorrect operation of the parameter desc in the file /cgi-bin/cstecgi.cgi. Attackers can exploit this vulnerability to access sensitive data, modify data, and completely deny service

Trust: 2.16

sources: NVD: CVE-2025-5903 // JVNDB: JVNDB-2025-007041 // CNVD: CNVD-2025-12874

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-12874

AFFECTED PRODUCTS

vendor:totolinkmodel:t10scope:eqversion:4.1.8cu.5207

Trust: 1.0

vendor:totolinkmodel:t10scope:eqversion:t10 firmware 4.1.8cu.5207

Trust: 0.8

vendor:totolinkmodel:t10scope: - version: -

Trust: 0.8

vendor:totolinkmodel:t10scope:eqversion: -

Trust: 0.8

vendor:totolinkmodel:t10 4.1.8cu.5207scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-12874 // JVNDB: JVNDB-2025-007041 // NVD: CVE-2025-5903

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-5903
value: HIGH

Trust: 1.0

OTHER: JVNDB-2025-007041
value: HIGH

Trust: 0.8

CNVD: CNVD-2025-12874
value: HIGH

Trust: 0.6

cna@vuldb.com: CVE-2025-5903
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-007041
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-12874
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-5903
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

OTHER: JVNDB-2025-007041
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-12874 // JVNDB: JVNDB-2025-007041 // NVD: CVE-2025-5903

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:CWE-120

Trust: 1.0

problemtype:Buffer error (CWE-119) [ others ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [NVD evaluation ]

Trust: 0.8

problemtype: Classic buffer overflow (CWE-120) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-007041 // NVD: CVE-2025-5903

EXTERNAL IDS

db:NVDid:CVE-2025-5903

Trust: 3.2

db:VULDBid:311676

Trust: 1.8

db:JVNDBid:JVNDB-2025-007041

Trust: 0.8

db:CNVDid:CNVD-2025-12874

Trust: 0.6

sources: CNVD: CNVD-2025-12874 // JVNDB: JVNDB-2025-007041 // NVD: CVE-2025-5903

REFERENCES

url:https://candle-throne-f75.notion.site/totolink-t10-setwifiaclrules-20bdf0aa118580399a8df6ba2a44c197

Trust: 1.8

url:https://vuldb.com/?id.311676

Trust: 1.8

url:https://vuldb.com/?submit.592247

Trust: 1.8

url:https://www.totolink.net/

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2025-5903

Trust: 1.4

url:https://vuldb.com/?ctiid.311676

Trust: 1.0

sources: CNVD: CNVD-2025-12874 // JVNDB: JVNDB-2025-007041 // NVD: CVE-2025-5903

SOURCES

db:CNVDid:CNVD-2025-12874
db:JVNDBid:JVNDB-2025-007041
db:NVDid:CVE-2025-5903

LAST UPDATE DATE

2025-06-21T23:17:57.596000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-12874date:2025-06-19T00:00:00
db:JVNDBid:JVNDB-2025-007041date:2025-06-17T00:57:00
db:NVDid:CVE-2025-5903date:2025-06-16T14:29:15.977

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-12874date:2025-06-19T00:00:00
db:JVNDBid:JVNDB-2025-007041date:2025-06-17T00:00:00
db:NVDid:CVE-2025-5903date:2025-06-10T00:15:22.243