TOTOLINK A3300R CVE-2025-12239

Exploitation requires network reachability to the device's web management service and invocation of the setDdnsCfg handler in /cgi-bin/cstecgi.cgi, which per the CVSS PR:L metric requires an authenticated low-privilege session on the TOTOLINK A3300R (firmware 17.0.0cu.557_B20221024). Limiting factors: only this specific firmware build is listed as affected; the attacker must reach the admin HTTP interface (typically LAN-only unless remote management is enabled); and valid credentials are needed, though default or weak credentials on consumer routers may trivially satisfy this. No user interaction is required (UI:N).

Signals are moderate and internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high confidentiality, integrity and availability impact to the vulnerable system yields 7.4 (High), reflecting a network-reachable, low-complexity buffer overflow that nonetheless requires some level of authentication (PR:L). EPSS is low at 0.84% (56th percentile), indicating no evidence of broad automated exploitation despite the public exploit, and the CVE is NOT on CISA KEV, so there is no confirmed active exploitation. Publicly available exploit code exists (GitHub PoC), which raises opportunistic risk, but the PR:L authentication requirement and the absence of KEV listing temper the real-world priority. This fits the pattern of a VulDB/CNA-reported consumer-router flaw: technically valid and PoC-backed, but affecting a single specific firmware build of a niche device, so it is a lower operational priority than its 7.4 score alone might suggest - unless you specifically operate this TOTOLINK model. Note the input provides only a CVSS 4.0 vector (no 3.1 vector) and the PR:L assignment is vendor-stated; verify whether the device's admin interface is exposed and whether default/weak credentials effectively lower the authentication barrier.

An attacker with access to the router's web interface (e.g., LAN access or an internet-exposed admin panel, potentially using default credentials) sends a crafted request to /cgi-bin/cstecgi.cgi invoking the setDdnsCfg function with an oversized parameter, triggering a buffer overflow. Given AC:L and a publicly available PoC, exploitation is straightforward and can corrupt memory to crash the device or potentially execute attacker-controlled code. The AV:N/PR:L vector means it is remotely reachable but requires an authenticated session.