cbcvebase.
CVE-2025-11444
published 2025-10-08

CVE-2025-11444: A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file…

PriorityP265high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.96%
57.5th percentile
A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi of the component HTTP Request Handler. Such manipulation of the argument wepkey leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

Affected

2 ranges
VendorProductVersion rangeFixed in
totolinkn600r——
totolinkn600r_firmware<= 4.3.0cu.7866_b2022506—

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/cstecgi.cgi↗
snort
alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink setWiFiBasicConfig wepkey Parameter Buffer Overflow Attempt (CVE-2025-11444)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"topicurl|3d|"; pcre:"/^(?:UploadCustomModule|setWiFiBasicConfig)/R"; content:"wepkey|3d|"; fast_pattern; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:url,github.com/z472421519/BinaryAudit/blob/main/PoC/BOF/TOTOLINK/wepkey/wepkey.md#reproduce; reference:cve,2025-11444; classtype:web-application-attack; sid:2065109; rev:1; metadata:affected_product TOTOLINK, created_at 2025_10_08, cve CVE_2025_11444, signature_severity Critical, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_10_08;)
  • →Match HTTP POST requests to /cgi-bin/cstecgi.cgi with a body containing 'topicurl=' set to 'setWiFiBasicConfig' (or 'UploadCustomModule') and a 'wepkey=' parameter value of 100 or more characters — indicative of a buffer overflow attempt.
  • →The URI target is exactly 20 bytes: /cgi-bin/cstecgi.cgi — use a strict URI length check (bsize:20) to reduce false positives.
  • →The attack is delivered remotely via HTTP POST; restrict monitoring to inbound traffic toward $HOME_NET on any port.
  • →The exploit PoC is publicly available on GitHub; threat actors may use it directly against TOTOLINK N600R devices running firmware up to 4.3.0cu.7866_B20220506. ↗
  • ·The Snort/Suricata rule (sid:2065109) also fires on 'UploadCustomModule' as the topicurl value, not only 'setWiFiBasicConfig' — ensure your tuning accounts for both function names to avoid missed detections.
  • ·The wepkey overflow threshold in the rule is set at 100 characters; legitimate wepkey values are far shorter (WEP keys max at 26 hex chars), so this threshold should produce very low false-positive rates.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.