T10 Firmware CVE-2025-5905

CVSS 3.1 score of 8.8 (High) combined with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates significant severity with network-exploitable attack vector and low complexity. The requirement for authenticated access (PR:L) creates a barrier, but considering widespread router default credentials and password reuse, this is a practical constraint in many deployments. The high impact across confidentiality, integrity, and availability reflects potential for complete device compromise. The public disclosure of exploit code dramatically increases real-world exploitation probability and should be considered equivalent to active exploitation in the wild. Without EPSS probability data, the combination of (1) public POC availability, (2) low attack complexity, (3) remote network vector, (4) critical functionality impact, and (5) commonly deployed consumer device creates a HIGH priority vulnerability requiring immediate patching. This is NOT a low-real-risk-high-CVSS situation; all signals align toward genuine critical threat.

An attacker with valid credentials (obtained through credential stuffing, default credentials, or phishing) connects to the TOTOLINK T10 router's web interface. The attacker sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with the setWiFiRepeaterCfg function call, including a Password parameter containing a payload significantly exceeding the expected buffer size (e.g., 5000+ bytes of data when only 256 bytes are allocated). The buffer overflow corrupts adjacent memory, potentially allowing the attacker to overwrite function return addresses on the stack. By carefully crafting the payload (as demonstrated in public POC code), the attacker can redirect execution to shellcode, achieving remote code execution with device privileges. Post-exploitation allows the attacker to establish persistent access, exfiltrate sensitive data (WiFi passwords, connected device information), modify device firmware, or use the device as a pivot point into the local network. Given POC availability, this attack can be executed by moderate-skill attackers without significant reverse engineering effort.