CVE-2025-5904

🗓️ 10 Jun 2025 00:00:16Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

Critical buffer overflow in TOTOLINK T10 due to setWiFiMeshName manipulation in POST request handler.

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the setWiFiMeshName function in the TOTOLink T10 mesh system, which allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.	20 Aug 202500:00	–	bdu_fstec
Circl	CVE-2025-5904	10 Jun 202500:30	–	circl
CNNVD	TOTOLINK T10 安全漏洞	9 Jun 202500:00	–	cnnvd
CNVD	TOTOLINK T10 Buffer Overflow Vulnerability (CNVD-2025-12749)	13 Jun 202500:00	–	cnvd
Cvelist	CVE-2025-5904 TOTOLINK T10 POST Request cstecgi.cgi setWiFiMeshName buffer overflow	10 Jun 202500:00	–	cvelist
EUVD	EUVD-2025-17609	3 Oct 202520:07	–	euvd
NVD	CVE-2025-5904	10 Jun 202500:15	–	nvd
OSV	CVE-2025-5904	10 Jun 202500:15	–	osv
Positive Technologies	PT-2025-24581 · Totolink · Totolink T10	7 Jun 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-5904	12 Jun 202500:18	–	redhatcve

NVD

Node

totolink t10_firmwareMatch4.1.8cu.5207

AND

totolink t10Match-

[
  {
    "vendor": "TOTOLINK",
    "product": "T10",
    "versions": [
      {
        "version": "4.1.8cu.5207",
        "status": "affected"
      }
    ],
    "modules": [
      "POST Request Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
totolink	www.totolink.net/
candle-throne-f75	www.candle-throne-f75.notion.site/TOTOLINK-T10-setWiFiMeshName-20bdf0aa1185806eb922dbd496c4a4b4
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
device_name	request body	cgi-bin/cstecgi.cgi	Remote buffer overflow via device_name parameter in POST request to /cgi-bin/cstecgi.cgi (setWiFiMeshName).	CWE-119, CWE-120

17 Jun 2026 09:48Current

8.9High risk

Vulners AI Score8.9

CVSS 48.7

CVSS 3.18.8

CVSS 29

CVSS 38.8

EPSS0.06928

SSVC