TOTOLINK A3300R CVE-2025-12259

Requires HTTP access to the router's management interface and the ability to send a POST request to /cgi-bin/cstecgi.cgi invoking the setScheduleCfg function with an attacker-controlled recHour parameter; the overflow is triggered specifically by an oversized recHour value. Per the input CVSS vector (PR:L), low-privilege authentication to the web interface is required, which limits exploitation to attackers who have or can obtain valid/default credentials or who can reach an exposed management interface - however, the description does not explicitly confirm this auth gate, so it should be verified. Exploitation is further bounded to the specific affected build (A3300R firmware 17.0.0cu.557_B20221024); no user interaction is needed (UI:N).

Signals are moderate and largely consistent. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 7.4) describes a remotely reachable, low-complexity attack that requires low-privilege authentication (PR:L) and yields high confidentiality, integrity and availability impact on the device - consistent with a stack-based buffer overflow (CWE-119) in the cstecgi.cgi POST handler of a SOHO router. Exploitation status is 'publicly available exploit code exists' (POC on GitHub); this is NOT CISA KEV, so there is no confirmed active exploitation. EPSS is low at 1.02% (62nd percentile), which does not conflict with POC availability - public PoC raises opportunity but EPSS reflects observed/predicted real-world exploitation volume, which remains modest. Note a tension worth flagging: the CVSS declares PR:L (authentication required), yet the terse VulDB-style description does not state the privilege prerequisite explicitly - verify whether the setScheduleCfg endpoint actually enforces authentication, because many TOTOLINK cstecgi.cgi endpoints have historically been reachable pre-auth, which would raise real risk. Overall this is a genuine but not top-tier priority: real memory-corruption flaw with public PoC, but gated by (claimed) authentication, low EPSS, no KEV, and confined to a single niche consumer router firmware build.

An attacker with network reachability to the router's web management interface (and, per the CVSS vector, low-level credentials) sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking setScheduleCfg with an overlong recHour argument. The oversized value overflows a stack buffer, corrupting the saved return address and enabling code execution or a crash/denial of service on the device. A public proof-of-concept for this exact endpoint is published on GitHub, lowering the bar to reproduce the attack.