CVE-2025-3674
published 2025-04-16CVE-2025-3674: A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function…
PriorityP333medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.52%
40.6th percentile
A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| totolink | a3700r | — | — |
| totolink | a3700r_firmware | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mfp5-c75h-8m74: A vulnerability was found in TOTOLINK A3700R 9
ghsa_unreviewed·2025-04-16
CVE-2025-3674 [MEDIUM] CWE-266 GHSA-mfp5-c75h-8m74: A vulnerability was found in TOTOLINK A3700R 9
A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Red Hat
kernel: Linux kernel: Denial of Service via NULL dereference in rtnl_create_link()
vendor_redhat·2025-07-10·CVSS 5.5
CVE-2025-38271 [MEDIUM] CWE-476 kernel: Linux kernel: Denial of Service via NULL dereference in rtnl_create_link()
kernel: Linux kernel: Denial of Service via NULL dereference in rtnl_create_link()
In the Linux kernel, the following vulnerability has been resolved:
net: prevent a NULL deref in rtnl_create_link()
At the time rtnl_create_link() is running, dev->netdev_ops is NULL,
we must not use netdev_lock_ops() or risk a NULL deref if
CONFIG_NET_SHAPER is defined.
Use netif_set_group() instead of dev_set_group().
RIP: 0010:netdev_need_ops_lock include/net/netdev_lock.h:33 [inline]
RIP: 0010:netdev_lock_ops include/net/netdev_lock.h:41 [inline]
RIP: 0010:dev_set_group+0xc0/0x230 net/core/dev_api.c:82
Call Trace:
rtnl_create_link+0x748/0xd10 net/core/rtnetlink.c:3674
rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3813
__rtnl_newlink net/core/rtnetlink.c:3940 [inline]
rtnl_newlink+0x16d6/0x1c70 n
No detection rules found.
No public exploits indexed.
https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setUrlFilterRules-1cb53a41781f808f9547da7748580914?pvs=4https://vuldb.com/?ctiid.304963https://vuldb.com/?id.304963https://vuldb.com/?submit.551302https://www.totolink.net/https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setUrlFilterRules-1cb53a41781f808f9547da7748580914
2025-04-16
Published