CVE-2025-1340CWE-119CWE-121

TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow

High · published February 16, 2025

CVSS v4.0

8.7

EPSS

17%

Percentile

97.0

In the wild

Unconfirmed

What it is

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v4.0: 8.7 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.16672 · 97.0th percentile
Weaknesses: CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-121 · Stack-based Buffer Overflow
Published: 2025-02-16T13:31Z

EPSS history

Timeline

16 FEB 13:31Z
TOTOLINK X18 cstecgi.cgi setPasswordCfg stack-based overflow
cvelistv5