CVE-2025-1340

Published Feb 16, 2025

Last updated 7 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-1340 is a critical vulnerability found in TOTOLINK X18 version 9.1.0cu.2024_B20220329. The vulnerability exists in the `setPasswordCfg` function within the `/cgi-bin/cstecgi.cgi` file. Manipulation of a string within this function can lead to a stack-based buffer overflow. This buffer overflow vulnerability can be exploited remotely. Public disclosure of the exploit has occurred, and it is potentially being actively used. Despite early contact, the vendor (TOTOLINK) has not responded.

Description: A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Source: cna@vuldb.com
NVD status: Received

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 2.0

Type: Secondary
Base score: 9
Impact score: 10
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:C/I:C/A:C

Weaknesses

cna@vuldb.com: CWE-119

Hype score: Not currently trending