Ex1200t Firmware CVE-2025-6302

This vulnerability presents HIGH real-world risk despite authentication requirement. CVSS 8.8 reflects the severity (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network-accessible, low-complexity exploitation requiring only low-privilege credentials. The PR:L (Privilege:Low) requirement is mitigated by widespread weak default credentials on TOTOLINK devices and the commonality of open DHCP configuration interfaces. Public POC availability and disclosed exploit significantly increase real-world exploitation likelihood. The CVSS vector shows no user interaction required and impacts all confidentiality, integrity, and availability dimensions. From an SSVC perspective: exploitation status = active/PoC-in-wild, automatable = yes (CGI parameter fuzzing), technical impact = total (RCE on router). This is NOT a false-positive high-CVSS issue—it represents genuine critical infrastructure risk for all deployed EX1200T units on this firmware version.

An attacker with knowledge of a target organization's router management credentials (obtained via phishing, default credentials, or credential reuse) authenticates to the TOTOLINK EX1200T web interface. The attacker navigates to the Static DHCP configuration page and crafts an HTTP POST request to /cgi-bin/cstecgi.cgi with a Comment parameter containing a carefully crafted payload exceeding the stack buffer size. The oversized input overwrites the stack frame, including the return address, redirecting execution to attacker-controlled shellcode. The attacker achieves arbitrary code execution on the router with root privileges, allowing them to: establish persistent backdoors, intercept all network traffic traversing the device, modify DNS responses, deploy malware, or pivot to other devices on the network. Given public POC availability, this exploit can be automated and scaled across vulnerable devices. The attack requires only low-privilege web interface access, making it accessible to inside threats or compromised user accounts.