CVE-2025-3674 — Incorrect Privilege Assignment in A3700r

CWE-266 — Incorrect Privilege AssignmentCWE-284 — Improper Access ControlCWE-476 — NULL Pointer Dereference4 documents4 sources
Severity
6.9MEDIUMNVD
EPSS
0.3%
top 42.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink A3700rTotolink A3700r Firmware
Timeline
PublishedApr 16
Latest updateJul 10

Description

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/a3700r9.1.2u.5822_B20200513
▶NVDtotolink/a3700r_firmware9.1.2u.5822_b20200513

🔴Vulnerability Details

2
GHSA
GHSA-mfp5-c75h-8m74: A vulnerability was found in TOTOLINK A3700R 9↗2025-04-16
▶
CVEList
TOTOLINK A3700R cstecgi.cgi setUrlFilterRules access control↗2025-04-16
▶

📋Vendor Advisories

1
Red Hat
kernel: Linux kernel: Denial of Service via NULL dereference in rtnl_create_link()↗2025-07-10
▶
CVE-2025-3674 — Incorrect Privilege Assignment | cvebase