T10 Firmware CVE-2025-5904

HIGH REAL-WORLD RISK. CVSS 8.8 reflects: AV:N (network-accessible), AC:L (low complexity, no special conditions), PR:L (requires login/authentication—moderate barrier), UI:N (no user interaction needed), S:U/C:H/I:H/A:H (complete system compromise). The PR:L requirement moderates risk compared to unauthenticated flaws, BUT this is offset by: (1) Public POC/exploit disclosure increases likelihood of weaponization, (2) Embedded device installed base means many unpatched systems remain in production, (3) Buffer overflows in firmware are trivial to exploit once POC exists, (4) Default credentials or credential compromise on routers is common. EPSS score (if available in threat intel feeds) would likely be elevated due to disclosure and exploitability. KEV status unknown from provided data but public exploit disclosure suggests strong likelihood of CISA tracking. SSVC assessment: Exploitation=PoC Available, Automatable=Yes (scripted overflow), Technical Impact=Complete (RCE as root on embedded device)—HIGH priority.

An attacker with access to the router's web admin panel (via default credentials, credential stuffing, phishing, or prior compromise of a user account) sends a crafted POST request to /cgi-bin/cstecgi.cgi with a specially crafted device_name parameter containing shellcode (e.g., >256 bytes of payload with ROP gadgets or direct shellcode). The unvalidated parameter overflows the buffer, overwrites the return address or function pointer on the stack, and redirects execution to the attacker's shellcode. The attacker achieves remote code execution as the root user (typical for CGI scripts on embedded devices), allowing them to: (1) Install persistent backdoors, (2) Harvest WiFi credentials and network traffic, (3) Pivot to other devices on the local network, (4) Modify DNS settings for man-in-the-middle attacks, (5) Participate in botnets. Low AC and public POC mean exploitation can be automated and scaled across vulnerable router populations with known credentials or via credential databases from prior breaches. The requirement for authentication (PR:L) is a modest hurdle given the prevalence of default or weak credentials in home router deployments.