CVE-2025-14964

Critical

Published: 19/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

A vulnerability in TOTOLINK T10 4.1.8cu.5083_B20200521 affects the sprintf function in the file /cgi-bin/cstecgi.cgi. Manipulation of the argument loginAuthUrl leads to a stack-based buffer overflow. The attack can be performed remotely.

Risk Assessment

Risk of remote code execution or device crash, potentially allowing an attacker to take control of the router and compromise network security.

Recommendation

Update the device firmware to the latest version and restrict administrative access.

Original NVD description (English source)

A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to stack-based buffer overflow. The attack may be performed from remote.