What is the CVSS score of EUVD-2025-17591?

EUVD-2025-17591 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of T10 Firmware are affected by EUVD-2025-17591?

A critical remote code execution vulnerability affecting TOTOLIK T10 routers (version 4.1.8cu.5207) allows unauthenticated attackers to execute arbitrary code through file upload functionality.

Is there a public PoC exploit available for EUVD-2025-17591?

Yes, a public proof-of-concept exploit is available for EUVD-2025-17591. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate EUVD-2025-17591?

Within 24 hours: Inventory all TOTOLINK T10 devices running vulnerable firmware and isolate them from production networks if possible; enable enhanced monitoring for suspicious activity on affected devices. Within 7 days: Implement network segmentation to restrict access to device management interfaces and segment affected devices from critical assets; deploy WAF rules to block POST requests to /cgi-bin/cstecgi.cgi with large file parameters. Within 30 days: Evaluate replacement with alternative vendor equipment or schedule firmware upgrade immediately upon patch availability; document all affected devices and assign ownership for continuous monitoring.

T10 Firmware EUVD-2025-17591

| CVE-2025-5901 HIGH

Buffer Overflow (CWE-119)

2025-06-09 cna@vuldb.com

Buffer Overflow TP-Link RCE T10 Firmware TOTOLINK

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17591

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

PoC Detected

Jun 16, 2025 - 14:36 vuln.today

Public exploit code

CVE Published

Jun 09, 2025 - 23:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability has been found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This vulnerability affects the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument File leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Critical buffer overflow vulnerability in TOTOLINK T10 firmware version 4.1.8cu.5207 affecting the UploadCustomModule function in the POST request handler at /cgi-bin/cstecgi.cgi. An authenticated remote attacker can exploit this vulnerability by manipulating the File argument to achieve buffer overflow, resulting in complete system compromise (confidentiality, integrity, and availability). The vulnerability has public exploit disclosure and represents an immediate threat to affected devices.

Technical ContextAI

This vulnerability exists in the CGI (Common Gateway Interface) request handler component of TOTOLIK T10 wireless router firmware. The root cause is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), a classic buffer overflow condition where user-supplied input (the File parameter) is not properly validated or bounded before being written to a fixed-size buffer. The UploadCustomModule function processes POST requests intended for custom module uploads but lacks input length validation. TOTOLINK T10 is identified by CPE: cpe:2.3:o:totolink:t10_firmware:4.1.8cu.5207:*:*:*:*:*:*:*. The vulnerable endpoint /cgi-bin/cstecgi.cgi processes HTTP POST requests with insufficient bounds checking on the File parameter, allowing an attacker to overflow adjacent memory regions and inject arbitrary code or corrupt critical data structures.

RemediationAI

Immediate actions: (1) If a patched firmware version is available, upgrade TOTOLINK T10 to the latest stable release immediately (check TOTOLINK's official firmware download portal); (2) Until patching is possible, restrict network access to /cgi-bin/cstecgi.cgi via firewall rules or router access control lists (ACLs); (3) Implement network segmentation to limit administrative access to the router's web interface to trusted internal networks only; (4) Change default and weak administrative credentials on all TOTOLINK T10 devices (authentication is required but weak credentials are commonly exploited); (5) Monitor TOTOLINK security advisories at their official website for patch release announcements. No specific patched firmware version is documented in available sources—contact TOTOLINK technical support (support@totolink.net or regional support channels) for patch availability and timeline. Legacy devices may not receive patches; consider replacement if no update is forthcoming.