CVE-2025-4496

🗓️ 10 May 2025 05:00:10Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 86 Views🌐 WEB

Critical vulnerability in TOTOLINK devices allows remote buffer overflow via CloudACMunualUpdate.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the CloudACMunualUpdate() function in the microprogrammed software routers of TOTOLINK T10, TOTOLINK A3100R, TOTOLINK A950RG, TOTOLINK A800R, TOTOLINK N600R, TOTOLINK A3000RU, and TOTOLINK A810R allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	23 May 202500:00	–	bdu_fstec
Circl	CVE-2025-4496	10 May 202505:26	–	circl
CNNVD	TOTOLINK多款产品安全漏洞	10 May 202500:00	–	cnnvd
Cvelist	CVE-2025-4496 TOTOLINK T10/A3100R/A950RG/A800R/N600R/A3000RU/A810R cstecgi.cgi CloudACMunualUpdate buffer overflow	10 May 202505:00	–	cvelist
EUVD	EUVD-2025-14220	3 Oct 202520:07	–	euvd
NVD	CVE-2025-4496	10 May 202505:15	–	nvd
OSV	CVE-2025-4496	10 May 202505:15	–	osv
Positive Technologies	PT-2025-20607 · Totolink · Totolink T10 +6	10 May 202500:00	–	ptsecurity
Positive Technologies	PT-2025-28953 · Undefined · Undefined	9 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-4496	12 May 202505:03	–	redhatcve

NVD

Node

AND

totolink a3000ru_firmwareMatch4.1.8cu.5241_b20210927

totolink a3000ruMatch-

Node

AND

totolink a810r_firmwareMatch4.1.8cu.5241_b20210927

totolink a810rMatch-

Node

AND

totolink t10_firmwareMatch4.1.8cu.5241_b20210927

totolink t10Match-

Node

AND

totolink a3100r_firmwareMatch4.1.8cu.5241_b20210927

totolink a3100rMatch-

Node

AND

totolink a950rg_firmwareMatch4.1.8cu.5241_b20210927

totolink a950rgMatch-

Node

AND

totolink a800r_firmwareMatch4.1.8cu.5241_b20210927

totolink a800rMatch-

Node

AND

totolink n600r_firmwareMatch4.1.8cu.5241_b20210927

totolink n600rMatch-

[
  {
    "vendor": "TOTOLINK",
    "product": "T10",
    "versions": [
      {
        "version": "4.1.8cu.5241_B20210927",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TOTOLINK",
    "product": "A3100R",
    "versions": [
      {
        "version": "4.1.8cu.5241_B20210927",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TOTOLINK",
    "product": "A950RG",
    "versions": [
      {
        "version": "4.1.8cu.5241_B20210927",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TOTOLINK",
    "product": "A800R",
    "versions": [
      {
        "version": "4.1.8cu.5241_B20210927",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TOTOLINK",
    "product": "N600R",
    "versions": [
      {
        "version": "4.1.8cu.5241_B20210927",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TOTOLINK",
    "product": "A3000RU",
    "versions": [
      {
        "version": "4.1.8cu.5241_B20210927",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "TOTOLINK",
    "product": "A810R",
    "versions": [
      {
        "version": "4.1.8cu.5241_B20210927",
        "status": "affected"
      }
    ]
  }
]

Source	Link
totolink	www.totolink.net/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/CH13hh/tmp_store_cc/blob/main/tt/ta/1.md

Parameter	Position	Path	Description	CWE
FileName	request body	/cgi-bin/cstecgi.cgi	Buffer overflow via manipulated FileName parameter in CloudACMunualUpdate function on /cgi-bin/cstecgi.cgi	CWE-119, CWE-120

17 Jun 2026 09:33Current

7.1High risk

Vulners AI Score7.1

CVSS 3.18.8 - 9.8

CVSS 48.7

CVSS 29

CVSS 38.8

EPSS0.00992

SSVC