CVE-2025-3675 — Incorrect Privilege Assignment in A3700r

CWE-266 — Incorrect Privilege AssignmentCWE-284 — Improper Access Control3 documents3 sources
Severity
6.9MEDIUMNVD
EPSS
0.6%
top 30.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink A3700rTotolink A3700r Firmware
Timeline
PublishedApr 16

Description

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been rated as critical. Affected by this issue is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/a3700r9.1.2u.5822_B20200513
▶NVDtotolink/a3700r_firmware9.1.2u.5822_b20200513

🔴Vulnerability Details

2
GHSA
GHSA-rj3p-xj8v-g5w3: A vulnerability was found in TOTOLINK A3700R 9↗2025-04-16
▶
CVEList
TOTOLINK A3700R cstecgi.cgi setL2tpServerCfg access control↗2025-04-16
▶
CVE-2025-3675 — Incorrect Privilege Assignment | cvebase