TOTOLINK A3300R CVE-2025-12260

Exploitation targets the setSyslogCfg function of the /cgi-bin/cstecgi.cgi endpoint (the POST Parameter Handler component) on TOTOLINK A3300R firmware 17.0.0cu.557_B20221024, triggered by supplying an oversized value in the 'enable' POST argument to overflow a stack buffer. Limiting factors: the attack surface is the device web/management interface, so the attacker must have network reachability to that interface (typically LAN or an exposed WAN management port), and the CVSS vector's PR:L implies a valid authenticated session is required - though the description's 'remotely' language does not confirm or deny pre-authentication access, so defenders should treat auth as a possible but unverified barrier. Only the one specific firmware build is listed as affected; no non-default configuration or user interaction is required.

Signals are moderately consistent and point to a real but not top-tier priority. The provided CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N, VC:H/VI:H/VA:H, base 7.4) indicates a network-reachable, low-complexity flaw that nonetheless requires some level of authentication (PR:L) and yields full compromise of the affected device. A public exploit exists (referenced GitHub PoC), which raises practical risk, but the vulnerability is NOT in CISA KEV and there is no evidence of active exploitation. EPSS is low-to-moderate at 1.02% (62th percentile), which is consistent with a disclosed PoC for a niche consumer router that has not yet seen mass automated exploitation. The embedded CVSS 4.0 Exploit Maturity is E:P (Proof-of-Concept), aligning with the 'public exploit, no confirmed in-the-wild use' picture. Note a mismatch to flag: the plain-language description says 'It is possible to launch the attack remotely' and does not mention authentication, yet the CVSS vector encodes PR:L - verify whether the setSyslogCfg endpoint actually requires a valid session, as many TOTOLINK cstecgi.cgi handlers have historically been reachable pre-auth. CWE-119 (improper memory bounds) matches the stated stack-based buffer overflow. Overall: a credible authenticated-RCE-class bug in a specific low-footprint SOHO router - meaningful for owners of that exact model, but not a broad enterprise emergency.

An attacker with network access to the router's web management interface sends a crafted POST request to /cgi-bin/cstecgi.cgi invoking the setSyslogCfg function with an oversized 'enable' argument, overflowing a stack buffer. A public proof-of-concept is available on GitHub, lowering the skill barrier. The CVSS vector's PR:L indicates a valid session/credential is expected, though the description's 'remotely' wording leaves pre-auth reachability unverified.