What is the CVSS score of CVE-2025-6138?

CVE-2025-6138 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2025-6138?

Yes, a public proof-of-concept exploit is available for CVE-2025-6138. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-6138?

Within 24 hours: Inventory all TOTOLINK T10 devices in your network and isolate affected units from critical systems if possible. Within 7 days: Contact TOTOLINK for patch availability and timeline; evaluate replacement or upgrade options given the lack of current patching. Within 30 days: Implement network segmentation to restrict router management access, deploy IDS/IPS signatures to detect exploitation attempts, and develop a device replacement plan if vendor patch is not released.

T10 Firmware CVE-2025-6138

EUVD-2025-18434 HIGH

Buffer Overflow (CWE-119)

2025-06-16 cna@vuldb.com

Buffer Overflow TP-Link T10 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS 3.1 score of 8.8 (High/Critical) with vector AV:N/AC:L/PR:L/UI:N/S:U reflects: Network Attack Vector (accessible remotely), Low Complexity (no special conditions required), Low Privilege requirement (authenticated user), no User Interaction needed, and Unchanged Scope with High impact across Confidentiality, Integrity, and Availability. The privilege requirement (PR:L) indicates authentication is required, which is a mitigating factor compared to unauthenticated exploits. However, the combination of public POC availability, disclosed vulnerability, and exploitability against an embedded device with limited patching infrastructure elevates real-world risk significantly. The CVSS does not fully capture the severity for IoT/embedded devices where patches may never be released or users may never apply them. This should be prioritized for immediate mitigation in critical network infrastructure deployments.
Exploit ScenarioDerived	An attacker with valid credentials (either obtained through credential compromise, phishing, or default credentials) accesses the TOTOLINK T10 web interface and sends a crafted HTTP POST request to /cgi-bin/cstecgi.cgi with an oversized ssid5g parameter exceeding the allocated buffer. The buffer overflow overwrites adjacent stack memory, potentially overwriting the return address or other control structures. The attacker leverages this to achieve remote code execution with device privileges, allowing them to: install backdoors, exfiltrate network traffic, pivot to internal network resources, modify router firmware, or cause a denial of service. Since the vulnerability requires authentication but no User Interaction is needed, it is particularly dangerous in scenarios where attackers have compromised admin credentials or where default credentials remain unchanged. Public POC code increases likelihood of script-kiddie level exploitation across deployed T10 devices.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

Critical buffer overflow vulnerability in TOTOLINK T10 firmware version 4.1.8cu.5207 affecting the HTTP POST request handler. An authenticated attacker can remotely exploit the setWizardCfg function via the ssid5g parameter to achieve buffer overflow, resulting in complete system compromise including confidentiality, integrity, and availability breaches. Public exploit code has been disclosed and the vulnerability meets criteria for active exploitation risk.

RemediationAI

Immediate actions: (1) If patched firmware is available from TOTOLINK for T10 model, upgrade immediately via the device's firmware update mechanism or web interface; (2) If no patch exists, restrict network access to the device's HTTP interface using firewall rules, allowing only trusted administrative IPs; (3) Change default credentials and enforce strong passwords to reduce authenticated attack surface; (4) Consider isolating affected T10 devices on a separate administrative network segment; (5) Monitor vendor security advisories at https://www.totolink.net for patch releases. Check TOTOLINK's support page for firmware downloads and security bulletins. As a temporary mitigation, disable remote management features if not required and restrict access to port 80/443 at the network perimeter.

Affected VersionsENISA

T10 4.1.8cu.5207

Affected Packages

euvd t10 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability exists in the cstecgi.cgi CGI binary, which processes HTTP POST requests for wireless router configuration. The setWizardCfg function fails to properly validate the length of the ssid5g input parameter before copying it into a fixed-size stack buffer, resulting in a classic stack-based buffer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). The affected component handles wireless SSID configuration for 5GHz band settings in the TOTOLINK T10 wireless router. This is a network-facing service running on the device's embedded HTTP server, making it remotely accessible to authenticated users or potentially unauthenticated users depending on authentication bypass conditions.

Know when T10 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Jun 20, 2025 - 14:34 vuln.today

Public exploit code

CVE Published

Jun 16, 2025 - 21:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability classified as critical was found in TOTOLINK T10 4.1.8cu.5207. Affected by this vulnerability is the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ssid5g leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

A remote code execution vulnerability affecting TOTOLIK T10 routers (model 4.1.8cu.5207) has been publicly disclosed with working exploits available. Organizations using this device are at immediate risk of unauthorized access and network compromise, as attackers can exploit the vulnerability without authentication.

Business Impact: High

Compensating Controls

Implement network segmentation to restrict HTTP POST access to the router's management interface; deploy WAF/IPS rules to detect and block POST requests to /cgi-bin/cstecgi.cgi with oversized ssid5g parameters; disable remote management access and restrict administrator access to internal networks only; monitor for suspicious HTTP POST traffic patterns; consider replacing affected devices with patched firmware versions or alternative vendors if TOTOLINK does not release a patch within 30 days.

Threat Intelligence Overview

EPSS Score

0.6%

Top 31% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.