CVE-2025-12260
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in TOTOLINK A3300R in the setSyslogCfg function of /cgi-bin/cstecgi.cgi, caused by manipulation of the enable argument. The attack can be launched remotely, and the exploit has been publicly disclosed.
Risk Assessment
A remote attack could lead to buffer overflow, potentially allowing arbitrary code execution or causing device crash, threatening network security.
Recommendation
Immediately update the TOTOLINK A3300R firmware to the latest version if available, and restrict access to the administrative interface.
Other vulnerabilities in TOTOLINK A3300R
See all- CVE-2023-37173Critical
The TOTOLINK A3300R device in version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.
- CVE-2023-37172Critical
A command injection vulnerability was discovered in the TOTOLINK A3300R device version V17.0.0cu.557_B20221024 via the ip parameter in the setDiagnosisCfg function.
- CVE-2023-37171Critical
The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 was found to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
- CVE-2023-37170Critical
The TOTOLINK A3300R device version V17.0.0cu.557_B20221024 has been found to contain an unauthenticated remote code execution (RCE) vulnerability via the lang parameter in the setLanguageCfg function.
- CVE-2023-31729Critical
TOTOLINK A3300R router firmware v17.0.0cu.557 is vulnerable to Command Injection via the /cgi-bin/cstecgi.cgi CGI script. An attacker can remotely execute arbitrary system commands without authentication.
- CVE-2026-5679Medium
A vulnerability was detected in Totolink A3300R 17.0.0cu.557_B20221024 allowing OS command injection via the vsetTr069Cfg function in /cgi-bin/cstecgi.cgi. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-12259High
A stack-based buffer overflow vulnerability was found in TOTOLINK A3300R in the setScheduleCfg function of /cgi-bin/cstecgi.cgi, caused by manipulation of the recHour argument. The attack can be initiated remotely, and the exploit has been published.
- CVE-2025-12258High
A stack-based buffer overflow vulnerability was detected in TOTOLINK A3300R in the setOpModeCfg function of /cgi-bin/cstecgi.cg, caused by manipulation of the opmode argument. The attack may be performed remotely.
- CVE-2025-12241High
A vulnerability was detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This impacts the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument lang results in stack-based buffer overflow. The attack can be launched remotely, and the exploit is now public.
- CVE-2025-12240High
A buffer overflow vulnerability was detected in TOTOLINK A3300R in the setDmzCfg function of /cgi-bin/cstecgi.cgi, caused by manipulation of the ip argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. Such manipulation of the argument enable leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS