T10 Firmware EUVD-2025-17591

This vulnerability presents CRITICAL real-world risk supported by converging threat signals: (1) CVSS 8.8 score with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-accessible exploitation requiring only low privileges (authenticated user), low attack complexity, and complete impact across confidentiality, integrity, and availability; (2) Public exploit disclosure significantly increases exploitation probability—this is not theoretical; (3) Authentication requirement (PR:L) is a notable mitigation factor but does not substantially reduce risk given that many organizations have weak router admin credentials or local network access; (4) Buffer overflow vulnerabilities are highly reliable to exploit with disclosed POC, increasing EPSS probability substantially above base CVSS. The combination of network accessibility, low complexity, authentication-only gate, and public POC makes this a priority 1 vulnerability. SSVC assessment: Exploitation=Achieved (public POC exists), Automatable=Yes (buffer overflow exploitation is scriptable), Technical Impact=Complete. This meets SSVC criteria for immediate patching.

An authenticated attacker with valid router admin credentials (obtained via credential stuffing, phishing, or default credentials) accesses the TOTOLINK T10 web interface and navigates to a custom module upload feature. The attacker crafts a malicious HTTP POST request to /cgi-bin/cstecgi.cgi with an oversized File parameter containing a payload that overflows the buffer allocated by UploadCustomModule. The overflow corrupts adjacent stack memory, allowing the attacker to overwrite the return address or function pointers. By chaining this with ROP gadgets or direct code injection (depending on memory protections), the attacker achieves remote code execution with router privileges, enabling them to exfiltrate network traffic, pivot to internal hosts, modify router configuration, or use the device as a botnet node. A public POC exists, reducing the barrier to exploitation—an attacker with basic CGI knowledge can trigger this vulnerability within minutes. The low attack complexity (AC:L) and lack of user interaction (UI:N) requirements mean exploitation does not require social engineering or timing precision.