TOTOLINK A3300R
CVE-2025-12241
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface over network
-
DeliveryAuthenticate with low-privilege credentials
-
ExploitSend crafted POST to cstecgi.cgi setLanguageCfg
-
ExecutionOverflow stack buffer via oversized lang argument
-
ImpactHijack execution and run code on device
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's HTTP management interface and low-privilege authenticated access (CVSS PR:L), after which the attacker sends a crafted POST request to /cgi-bin/cstecgi.cgi calling the setLanguageCfg function with an over-length 'lang' parameter to overflow a stack buffer. Limiting factors: valid credentials to the web admin interface are needed (not unauthenticated), and the issue is confirmed only against TOTOLINK A3300R firmware 17.0.0cu.557_B20221024, narrowing the exposed population. On SOHO devices the authentication barrier is frequently weakened by default or unchanged credentials and interfaces exposed to the LAN or, if misconfigured, the WAN. |
| Impact | Signals are mixed and point to a moderate, not top-tier, priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high impact across VC/VI/VA yields 7.4, reflecting network reachability and low attack complexity but requiring low-privilege authentication (PR:L) - this is NOT an unauthenticated flaw. A public exploit exists (E:P, confirmed by the GitHub reference), which raises practical risk. However, EPSS is only 1.03% (63rd percentile), indicating low modeled probability of widespread exploitation, and the CVE is NOT in CISA KEV, so there is no evidence of active in-the-wild exploitation. SSVC-style reading: exploitation=PoC, technical impact=total (device code execution), but automatable exploitation is constrained by the authentication requirement. Net: a genuine but targeted-risk issue - the PR:L requirement and narrow single-firmware scope temper the otherwise high technical impact. The dependence on authentication is the key mitigating factor; on SOHO routers this is often weakened by default or reused credentials, which is why this still warrants patching/replacement rather than deprioritization. |
| Exploit ScenarioDerived | An attacker with low-privilege access to the router's web management interface (or valid/default credentials) sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking setLanguageCfg with an oversized 'lang' argument, overflowing a stack buffer to hijack execution and run arbitrary code on the device. A public proof-of-concept is available (referenced on GitHub), lowering the barrier to reproduction. Low attack complexity (AC:L) and network vector (AV:N) mean the request itself is trivial once interface access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Authenticated stack-based buffer overflow in the TOTOLINK A3300R SOHO router (firmware 17.0.0cu.557_B20221024) allows a remote attacker holding valid web-management credentials to corrupt memory by sending an over-length 'lang' value to the setLanguageCfg function of /cgi-bin/cstecgi.cgi, resulting in a device crash and, depending on the runtime build, potential code execution with full loss of confidentiality, integrity and availability. Publicly available exploit code exists (a step-by-step proof-of-concept for this exact firmware is published on GitHub), but the flaw is not in CISA KEV, so active exploitation is not confirmed; EPSS is 1.03% (63rd percentile), a moderate score consistent with a targeted IoT/router issue rather than mass scanning. Both the CVSS 4.0 base of 7.4 and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) agree on High impacts but require the attacker to first reach the router's HTTP management interface and authenticate at low privilege (PR:L), and only the one firmware build listed under the CPE is confirmed affected.
RemediationAI
No vendor-released patch is identified in the available data for firmware 17.0.0cu.557_B20221024, so the primary action is to check TOTOLINK's support site (https://www.totolink.net/) and the VULDB entries (https://vuldb.com/?id.329911) for a fixed firmware image and apply it as soon as one is published. Until then, treat the web management interface as a hostile-facing service: disable WAN-side remote management, keep the administration UI reachable only from a trusted LAN segment or an isolated management VLAN, and change any default or vendor-shipped administrator credentials, since the attack requires only low-privilege authenticated access - note that LAN-only restriction breaks remote administration workflows, and credential hardening is ineffective against an attacker who already holds valid tokens. Additional compensating controls include placing the router behind a firewall rule that blocks inbound access to /cgi-bin/cstecgi.cgi and the HTTP/HTTPS management ports from untrusted networks (trade-off: also blocks legitimate remote configuration), monitoring for unusually long 'lang' parameter values in POSTs to the CGI endpoint, and, where feasible, replacing the device with a model that receives active firmware maintenance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is reported under CWE-119 (improper restriction of operations within the bounds of a memory buffer), with the concrete manifestation being a stack-based overflow of the class usually tracked as CWE-121. TOTOLINK A3300R firmware exposes an embedded HTTP management server whose backend is the CGI binary /cgi-bin/cstecgi.cgi, a common pattern on MIPS-based Linux SOHO routers. The setLanguageCfg routine handled by that binary takes the POST parameter 'lang' and copies it into a fixed-size stack buffer without validating length, so an attacker-controlled oversized string overwrites adjacent stack memory (saved registers and return address), causing a crash and offering a classic control-flow hijack primitive where the build lacks stack protections. The affected asset is captured by the CPE cpe:2.3:o:totolink:a3300r_firmware:17.0.0cu.557_b20221024, i.e. the operating system image of the A3300R rather than a standalone application; no scope change (SC:N/SI:N/SA:N) and no user interaction (UI:N) are involved, and the attack is network-reachable (AV:N) but gated by low-privilege authentication (PR:L) to the web admin interface.
Know when A3300R Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-reachable CGI endpoint (AV:N) with trivial request (AC:L) but requires authenticated web-interface access (PR:L); buffer overflow yields device code execution, so C/I/A all High.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. The manipulation of the argument lang results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
Executive ViewAI
A high-severity memory-corruption flaw in the TOTOLINK A3300R small-office/home-office router lets anyone holding valid web-management credentials crash the device or, depending on the running build, run code with full control over the hardware - exposing branch offices, retail sites and remote-worker networks that depend on this model to both outage and use as a pivot into the corporate network. No vendor patch is available, and step-by-step exploitation instructions for this exact firmware are already published publicly, so weak, shared or default administrative credentials become a practical attack path. Leadership should treat this as an exposure-reduction issue requiring immediate credential and network-placement decisions rather than waiting on a firmware fix that does not yet exist.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote/WAN administration and UPnP, restrict management access to a trusted VLAN or IP allowlist, enforce unique strong administrator credentials and rotate any shared ones, segment affected routers away from internal systems, enable logging and alerting for crashes or config changes, and plan hardware replacement with a vendor-supported model.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
More in A3300R Firmware
View allTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc paramet
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url paramete
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enab
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass pa
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable pa
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param
In TOTOLINK A3300R V17.0.0cu.557_B20221024 when dealing with setLedCfg request, there is no verification for the enable
TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFil
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the command para
Exploit-DB