T10 Firmware CVE-2025-6137

This vulnerability presents severe real-world risk across multiple dimensions: (1) CVSS Vector Analysis - AV:N/AC:L/PR:L indicates network-accessible exploitation with low complexity requiring only low-level authentication (standard user credentials), maximizing practical attack surface; (2) Impact Severity - The C:H/I:H/A:H triple indicates complete system compromise including code execution potential; (3) Exploitation Status - Public disclosure of exploit code combined with low attack complexity and authenticated-but-not-admin requirements dramatically increases real-world exploitation probability; (4) Device Context - TOTOLIK routers are home/SMB-grade networking devices with typically weak default credentials and poor patch management, making authenticated access trivial; (5) SSVC Considerations - While PR:L reduces severity versus unauthenticated attacks, the automatable nature of buffer overflow exploitation and the widespread vulnerable firmware version create urgent priority. This is NOT a low-real-risk scenario despite moderate CVSS: it represents high exploitation probability in active deployments.

An attacker with low-privilege access to a TOTOLIK T10 network (e.g., guest WiFi user, weak credentials) crafts an HTTP POST request to /cgi-bin/cstecgi.cgi targeting the setWiFiScheduleCfg function. The attacker supplies a deliberately oversized 'desc' parameter (typically hundreds of bytes) exceeding the stack buffer size, overwriting adjacent memory. If successful, this overwrites function return pointers or heap metadata, allowing arbitrary code execution with router privileges. Given public exploit availability, this attack is highly automatable—an attacker could scan networks for vulnerable T10 devices (identifiable by default response headers/UPnP announcements) and deploy exploitation toolkit automatically. Timeline: initial compromise to complete router control achievable in seconds. Impact: router becomes bot-infected, enabling man-in-the-middle attacks, DNS hijacking, or use as pivot point into internal networks.