cve.bz

CVE-2025-5903

7.4 highEPSS 11%

High (7.4) in totolink t10 firmware. EPSS 11% chance of exploitation in the next 30 days.

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Severity

CVSS 4.0

7.4 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
11% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWEs
CWE-120, CWE-119
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON