CVE-2025-4270

🗓️ 05 May 2025 07:31:07Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 68 Views🌐 WEB

Vulnerability in TOTOLINK A720R remote attack exposes sensitive information via Config Handler.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2025-4270	5 May 202510:21	–	circl
CNNVD	TOTOLINK A720R 访问控制错误漏洞	5 May 202500:00	–	cnnvd
CNVD	TOTOLINK A720R Access Control Error Vulnerability	14 May 202500:00	–	cnvd
Cvelist	CVE-2025-4270 TOTOLINK A720R Config cstecgi.cgi information disclosure	5 May 202507:31	–	cvelist
EUVD	EUVD-2025-14980	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4270	5 May 202508:15	–	nvd
OSV	CVE-2025-4270	5 May 202508:15	–	osv
Positive Technologies	PT-2025-19350 · Totolink · Totolink A720R	5 May 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4270	7 May 202508:31	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-4270	30 Jul 202500:00	–	vulncheck_kev

NVD

Node

totolink a720r_firmwareMatch4.1.5cu.374

AND

totolink a720rMatch-

[
  {
    "vendor": "TOTOLINK",
    "product": "A720R",
    "versions": [
      {
        "version": "4.1.5cu.374",
        "status": "affected"
      }
    ],
    "modules": [
      "Config Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
totolink	www.totolink.net/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getSysStatusCfg.md
github	www.github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getInitCfg.md

Parameter	Position	Path	Description	CWE
topicurl	query param	cgi-bin/cstecgi.cgi	Information disclosure via manipulation of the topicurl parameter (values getInitCfg/getSysStatusCfg) on TOTOLINK A720R 4.1.5cu.374.	CWE-284, CWE-200

07 May 2025 16:38Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.15.3 - 7.5

CVSS 25

CVSS 46.9

CVSS 35.3

EPSS0.00398

SSVC

cve-2025-4270 totolink a720r information disclosure remote attack config handler exploit disclosed