EUVD-2025-18439CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Analysis
Critical buffer overflow vulnerability in TOTOLINK T10 firmware version 4.1.8cu.5207 affecting the setWiFiScheduleCfg function in the HTTP POST request handler. An authenticated remote attacker can exploit this vulnerability by manipulating the 'desc' parameter to achieve buffer overflow, resulting in complete compromise of confidentiality, integrity, and availability. A public exploit has been disclosed and the vulnerability is likely actively exploited given its critical CVSS score of 8.8 and low attack complexity.
Technical Context
The vulnerability exists in the TOTOLINK T10 router's CGI-based HTTP request handler (/cgi-bin/cstecgi.cgi). The setWiFiScheduleCfg function fails to properly validate or bound-check user-supplied input in the 'desc' parameter before copying it into a fixed-size buffer, creating a classic stack-based or heap-based buffer overflow condition classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). This is a common vulnerability class in embedded device firmware where C-based CGI handlers lack modern memory safety protections. The HTTP POST request handler processes administrative configuration requests, making this endpoint a natural attack surface for authenticated users or those who can bypass authentication.
Affected Products
T10 (['4.1.8cu.5207'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today