T10 Firmware EUVD-2025-17612

This vulnerability presents HIGH real-world risk across multiple threat intelligence signals: (1) CVSS 8.8 with network-accessible attack vector (AV:N) and low complexity (AC:L) indicates ease of exploitation; (2) requires only low privileges (PR:L), meaning any authenticated user on the network can trigger the flaw; (3) public POC availability dramatically increases exploitation probability and lowers the barrier to entry for opportunistic attackers; (4) the firmware version affected (4.1.8cu.5207) appears to be recent/current, suggesting widespread deployment; (5) impact is CRITICAL across CIA triad (C:H, I:H, A:H), enabling complete router compromise and lateral network attacks. KEV/CISA tracking status would confirm active real-world exploitation. The SSVC framework would likely rate this as SCHEDULED remediation priority given public exploitation code and network reachability. EPSS score (not provided but inferred as high given public POC and auth requirement) combined with CVSS 8.8 suggests this is NOT a 'high-CVSS-but-low-risk' issue—it is a genuine, exploitable, high-impact threat.

An attacker with network access to a TOTOLINK T10 router (either on the same LAN or via remote admin if enabled) authenticates to the web management interface using default or weak credentials, or leverages a prior compromise to obtain low-privilege access. The attacker crafts a malicious HTTP POST request to /cgi-bin/cstecgi.cgi with the setWiFiAclRules action, embedding an oversized payload in the 'desc' parameter (e.g., a long string exceeding the expected buffer size). The buffer overflow overwrites adjacent memory, corrupting the function return address or other control flow pointers. By carefully crafting the overflow payload (using publicly available POC code), the attacker achieves remote code execution (RCE) on the router with root/system privileges. From this position, the attacker can: install persistent backdoors, exfiltrate network traffic, pivot to connected devices, modify firewall rules, or render the router inoperative (denial of service). The low attack complexity and public POC mean this scenario is highly reproducible and likely already occurring in the wild.