Totolink A7000R CVE-2025-63462

Exploitation requires the attacker to reach the firmware endpoint that processes the wifiOff parameter through the sub_421A04 function on the Totolink A7000R running firmware v9.1.0u.6115_B20201022; the request must carry an oversized wifiOff value to overflow the stack buffer. The available sources do not state which interface (web admin, CGI endpoint) handles this parameter or whether authentication is required before reaching sub_421A04, so the practical precondition is network access to that specific service. Limiting factors: impact is confined to Denial of Service (device crash/reboot) with no code-execution, data-disclosure, or integrity consequence claimed; and for a SOHO router, network reachability in practice usually means LAN-side access unless remote administration is enabled to the WAN, which would narrow the realistic attacker population.

Signals point to a moderate, not emergency, priority. The CVSS 3.1 base score of 7.5 is driven entirely by availability impact (A:H) with no confidentiality or integrity impact (C:N/I:N), consistent with the described Denial of Service outcome; the vector claims network reach with low complexity and no privileges or user interaction (AV:N/AC:L/PR:N/UI:N). These exploitability signals are tempered by real-world indicators: EPSS is low at 0.41% (35th percentile), the CVE is not listed in CISA KEV, and exploitation status is 'no public exploit identified' in the strict sense - only a reference PoC exists, not verified as working exploit code. The vendor-priority Decision label is 'this_week', which aligns with a patch-in-ordinary-course posture rather than act_now/emergency. One caveat: 'network vector' for a SOHO router typically means an attacker who can already reach the device's management/web interface (LAN-side, or WAN only if remote administration is exposed); the description does not state the interface or whether authentication precedes the vulnerable sub_421A04 code path, so the effective reachability may be narrower than AV:N/PR:N suggests - verify the exposure of the affected endpoint. Net: a genuine but availability-only (device crash/reboot) issue on a consumer router, low probability of widespread exploitation, worth routine patching rather than crisis response.

An attacker who can reach the A7000R's affected web/management interface sends a crafted request with an overlong wifiOff parameter, overflowing a stack buffer in the sub_421A04 function and crashing the service or rebooting the device, denying connectivity to users behind it. A public PoC reference exists but is not verified as working exploit code. With CVSS AV:N/AC:L/PR:N/UI:N the request is simple to craft and requires no user interaction, though actual reach depends on whether the vulnerable endpoint is exposed to the attacker's network position.