What is the CVSS score of CVE-2025-5904?

CVE-2025-5904 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of T10 Firmware are affected by CVE-2025-5904?

A critical remote code execution vulnerability affects TOTOLIK T10 wireless mesh devices (version 4.1.8cu.5207) with no available patch.

Is there a public PoC exploit available for CVE-2025-5904?

Yes, a public proof-of-concept exploit is available for CVE-2025-5904. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-5904?

Within 24 hours: Audit inventory of all TOTOLINK T10 devices in production and segment them from critical network infrastructure. Within 7 days: Implement network-level protections (WAF rules blocking suspicious cstecgi.cgi requests, restrict administrative access to trusted IPs only) and disable WiFi mesh configuration features if operationally feasible. Within 30 days: Develop migration plan to alternative vendor solutions and establish timeline for device replacement, as no patch is available.

T10 Firmware CVE-2025-5904

EUVD-2025-17609 HIGH

Buffer Overflow (CWE-119)

2025-06-10 cna@vuldb.com

Buffer Overflow TP-Link RCE T10 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17609

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

PoC Detected

Jun 16, 2025 - 14:26 vuln.today

Public exploit code

CVE Published

Jun 10, 2025 - 00:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument device_name leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical buffer overflow vulnerability exists in TOTOLINK T10 firmware version 4.1.8cu.5207 in the setWiFiMeshName function of the POST request handler (/cgi-bin/cstecgi.cgi). An authenticated remote attacker can overflow the device_name parameter to achieve arbitrary code execution with complete system compromise (confidentiality, integrity, and availability impact). Public exploit code is available, elevating real-world risk despite the requirement for authenticated access.

Technical ContextAI

This vulnerability is a classic stack-based or heap-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) in a CGI script commonly used in embedded Linux-based routers. The TOTOLINK T10 is a mesh WiFi router running a web-accessible CGI interface for configuration. The vulnerable endpoint /cgi-bin/cstecgi.cgi processes POST requests to modify WiFi mesh network names. The setWiFiMeshName function fails to validate or bounds-check the device_name input parameter before copying it into a fixed-size buffer, allowing an attacker to overwrite adjacent stack or heap memory. This is typical of embedded device firmware where legacy C code lacks modern memory safety protections. CPE affected: cpe:2.3:o:totolink:t10_firmware:4.1.8cu.5207:*:*:*:*:*:*:*

RemediationAI

PRIMARY: Upgrade to patched firmware version from TOTOLINK (version number not provided in input—contact TOTOLINK support or check official firmware page for T10 updates post-4.1.8cu.5207). INTERIM MITIGATIONS: (1) Restrict access to the router's web admin interface via firewall rules—block /cgi-bin/cstecgi.cgi endpoint if not required for remote management, (2) Disable remote web administration if possible; use only local network access, (3) Change default router credentials to strong, unique passwords to reduce likelihood of authentication bypass, (4) Isolate the router on a segmented network to limit lateral movement if exploited, (5) Monitor for suspicious CGI requests containing overflow payloads (e.g., unusually long device_name parameters). PATCH TIMELINE: No specific patch date provided—assume vendor is developing fix; check TOTOLINK advisories within 30 days of CVE publication.