TOTOLINK N600R CVE-2025-11444

Requires network reachability to the router's HTTP management interface (/cgi-bin/cstecgi.cgi) and low-privilege authenticated access (CVSS PR:L) to invoke the setWiFiBasicConfig function. The specific trigger is supplying an overlong value in the 'wepkey' parameter of that WiFi basic-config endpoint. Limiting factors: the attacker must first obtain valid credentials (though SOHO routers frequently ship with default/weak passwords), the management interface must be reachable from the attacker's position (LAN by default, or WAN only if remote management is enabled), and only firmware versions up to 4.3.0cu.7866_B20220506 on the N600R are affected.

Signals are moderate and largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low-privilege authentication, with high confidentiality, integrity and availability impact to the vulnerable device (VC:H/VI:H/VA:H) but no scope change to other systems - yielding a base score of 7.4 (High). A public PoC exists (E:P in the vector, and a GitHub advisory), which raises practical risk, but EPSS is only 1.04% (63rd percentile), indicating no observed mass-exploitation activity yet. This CVE is NOT on CISA KEV, so there is no confirmed active exploitation. The key limiting factor is PR:L: exploitation requires authenticated access to the router's web management interface, which materially reduces exposure versus a fully unauthenticated flaw - though default/weak credentials on SOHO routers often erode this barrier. Net: a genuine but second-tier priority - real because of code-maturity (public exploit) and full-device compromise potential, tempered by the authentication requirement, low EPSS, and the niche consumer-router footprint. No conflicting data: the CVSS network vector is consistent with the 'launched remotely' description against the HTTP handler.

An attacker with valid (or default/weak) credentials to the N600R web interface sends a crafted HTTP POST to /cgi-bin/cstecgi.cgi invoking setWiFiBasicConfig with an oversized 'wepkey' argument, overflowing a fixed-size buffer in the request handler. A public proof-of-concept is available, so the overflow can be reliably triggered to crash the device or, with further work, achieve code execution on the router. Because the attack is low-complexity and network-reachable, it is practical against any reachable management interface once minimal authentication is obtained.