CVE-2025-5902: A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file…

PriorityP269high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

3.87%

89.0th percentile

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component POST Request Handler. The manipulation of the argument slaveIpList leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
totolink	t10	—	—
totolink	t10_firmware	—	—

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/cstecgi.cgi↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink setUpgradeFW slaveIpList Parameter Command Injection Attempt (CVE-2025-5902)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"|22|setUpgradeFW|22|"; fast_pattern; content:"|22|slaveIpList|22|"; pcre:"/^[^\x2c\x7d$]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,candle-throne-f75.notion.site/TOTOLINK-T10-setUpgradeFW-20bdf0aa11858089bc28f634bb140d00; reference:cve,2025-5902; classtype:attempted-admin; sid:2062870; rev:1; metadata:affected_product TOTOLINK, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_06_10, cve CVE_2025_5902, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, updated_at 2025_06_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

→Match POST requests to /cgi-bin/cstecgi.cgi where the request body contains the string 'setUpgradeFW' and 'slaveIpList', then inspect the slaveIpList value for shell metacharacters: semicolon (;/%3B), newline (\x0a/%0A), backtick (`/%60), pipe (|/%7C), or dollar sign ($/%24).
→The URI match uses a fixed body size of 20 bytes for /cgi-bin/cstecgi.cgi, which can be used as an additional filter to reduce false positives.
→Traffic is expected in plaintext (no TLS); the attack targets networking equipment via an externally reachable POST Request Handler, consistent with perimeter and internal deployment detection.
→The vulnerability is in the setUpgradeFW function of TOTOLINK T10 version 4.1.8cu.5207; the manipulation of the slaveIpList argument leads to buffer overflow exploitable remotely.

·The Snort/Suricata rule (ET sid:2062870) targets plaintext HTTP only; encrypted (HTTPS) traffic to the device will not be detected by this signature.
·The exploit has been publicly disclosed; treat all TOTOLINK T10 4.1.8cu.5207 devices as immediately at risk until patched.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.07.4HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_SPECIFIC_APPS Totolink setUpgradeFW slaveIpList Parameter Command Injection Attempt (CVE-2025-5902)

suricata·2025-06-10·CVSS 7.4

CVE-2025-5902 [HIGH] ET WEB_SPECIFIC_APPS Totolink setUpgradeFW slaveIpList Parameter Command Injection Attempt (CVE-2025-5902) ET WEB_SPECIFIC_APPS Totolink setUpgradeFW slaveIpList Parameter Command Injection Attempt (CVE-2025-5902) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Totolink setUpgradeFW slaveIpList Parameter Command Injection Attempt (CVE-2025-5902)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"|22|setUpgradeFW|22|"; fast_pattern; content:"|22|slaveIpList|22|"; pcre:"/^[^\x2c\x7d$]*?(?:(?:\x3b|%3[Bb])|(?:\x0a|%0[Aa])|(?:\x60|%60)|(?:\x7c|%7[Cc])|(?:\x24|%24))+/R"; reference:url,candle-throne-f75.notion.site/TOTOLINK-T10-setUpgradeFW-20bdf0aa11858089bc28f634bb140d00; reference:cve,2025-5902; classtype:attempted-admin; sid:2062870; rev:1; metadata:affected_product TOTOLINK, attack_target

Suricata

ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1

suricata·2020-07-05·CVSS 9.8

CVE-2020-5902 [CRITICAL] ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1 ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1 Rule: alert http any any -> any any (msg:"ET EXPLOIT F5 TMUI RCE vulnerability CVE-2020-5902 Attempt M1"; flow:established,to_server; http.uri; content:"/tmui/login.jsp"; startswith; fast_pattern; content:"|3b|"; distance:0; reference:cve,2020-5902; reference:url,support.f5.com/csp/article/K52145254; classtype:attempted-admin; sid:2030469; rev:7; metadata:affected_product F5, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2020_07_05, cve CVE_2020_5902, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Critical, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_03_25; target:dest_ip;)