CVE-2025-12260CWE-119CWE-121

CVE-2025-12260

High · published October 27, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
63.2
In the wild
Unconfirmed
What it is

🚨 A single remote request can trigger a stack-based buffer overflow in your TOTOLINK A3300R! This vulnerability is ripe for exploitation and needs immediate attention! 🔥 Think of it as a restaurant where the chef relies on a recipe with missing ingredients — one wrong move could lead to a disastrous dish. Similarly, the vulnerability in the setSyslogCfg function allows an attacker to overflow the stack like a recipe overflowing on the counter! An attacker could exploit this vulnerability to cause a system crash or potentially execute malicious code, gaining control over the device. This could lead to unauthorized access to your network, compromising sensitive data and systems, making your entire setup vulnerable to other attacks.

Put simply

Think of it as a restaurant where the chef relies on a recipe with missing ingredients — one wrong move could lead to a disastrous dish. Similarly, the vulnerability in the setSyslogCfg function allows an attacker to overflow the stack like a recipe overflowing on the counter! This vulnerability in the TOTOLINK A3300R's POST Parameter Handler occurs when the argument 'enable' in the setSyslogCfg function is manipulated, leading to a stack-based buffer overflow. This allows attackers to execute arbitrary code remotely, effectively taking control of the device.

What to do

An attacker could exploit this vulnerability to cause a system crash or potentially execute malicious code, gaining control over the device. This could lead to unauthorized access to your network, compromising sensitive data and systems, making your entire setup vulnerable to other attacks. To mitigate this risk, update your TOTOLINK A3300R firmware to the latest secure version as soon as possible. Regularly check for updates and consider enabling robust network security measures, such as firewalls or VPNs, to protect against unauthorized access. You've got this! By taking these steps, you'll be well on your way to securing your network. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01024 · 63.2th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published
2025-10-27T14:15Z
Affected products (1)
ProductVersionsFixed in
totolink/a3300r_firmwareall versions—
References (5)
EPSS history
Timeline
  • 27 OCT 10:02Z
    TOTOLINK A3300R POST Parameter cstecgi.cgi setSyslogCfg stack-based overflow
    cvelistv5