CVE-2025-7460

CWE-119 — Buffer OverflowCWE-120 — Classic Buffer Overflow3 documents3 sources
Severity
7.4HIGH
EPSS
0.6%
top 30.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink T6Totolink T6 Firmware
Timeline
PublishedJul 11
Latest updateJul 12

Description

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/t64.1.5cu.748_B20211015
▶NVDtotolink/t6_firmwarev4.1.5cu.748_b20211015

🔴Vulnerability Details

2
GHSA
GHSA-xgh4-wmvj-9mvr: A vulnerability has been found in TOTOLINK T6 4↗2025-07-12
▶
CVEList
TOTOLINK T6 HTTP POST Request cstecgi.cgi setWiFiAclRules buffer overflow↗2025-07-11
▶