CVE-2025-12240CWE-119CWE-120

CVE-2025-12240

High · published October 27, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

⚡ A single dodgy IP address is all it takes to trigger a buffer overflow in TOTOLINK A3300R! This vulnerability is like a sneaky delivery that overfills a package and causes a mess. 📦 Think of it as a package delivery system where the size limit is ignored. When someone sends in an oversized package (the manipulated IP), it spills out everywhere, disrupting the whole system! This buffer overflow could allow an attacker to gain unauthorized access or even crash the router, potentially exposing your entire network. Imagine someone hijacking your Wi-Fi and doing whatever they want—changing settings, spying on traffic, or worse!

Put simply

Think of it as a package delivery system where the size limit is ignored. When someone sends in an oversized package (the manipulated IP), it spills out everywhere, disrupting the whole system! The vulnerability lies in the setDmzCfg function of the /cgi-bin/cstecgi.cgi file, where improper handling of the IP argument can lead to a buffer overflow, allowing attackers to execute arbitrary code remotely.

What to do

This buffer overflow could allow an attacker to gain unauthorized access or even crash the router, potentially exposing your entire network. Imagine someone hijacking your Wi-Fi and doing whatever they want—changing settings, spying on traffic, or worse! To secure your devices, immediately patch to the latest firmware version provided by TOTOLINK, monitor your network for suspicious activity, and consider implementing stricter firewall rules. Don't leave any loose ends! You've got this! With a little attention and timely patching, you’ll be the network security hero! 🦸

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00836 · 57.3th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-10-27T11:15Z
Affected products (1)
ProductVersionsFixed in
totolink/a3300r_firmwareall versions—
References (5)
EPSS history
Timeline
  • 27 OCT 06:32Z
    TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflow
    cvelistv5