CVE-2025-9303

7.4 highEPSS 0.9%

High (7.4) in totolink a720r firmware. EPSS 0.9% chance of exploitation in the next 30 days.

A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument desc results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

Severity

CVSS 4.0

7.4 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWEs: CWE-120, CWE-119
Published: 2025-08-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

totolink:a720r_firmware

References

https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md
https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md#poc
https://vuldb.com/?ctiid.320908
https://vuldb.com/?id.320908
https://vuldb.com/?submit.632410

Check your stack JSON