CVE-2025-4269: TOTOLINK A720R Log cstecgi.cgi access control

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-05 · updated 2026-06-17
Weakness: CWE-266

Description

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products

TOTOLINK A720R: 4.1.5cu.374

References

https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearDiagnosisLog.md
https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/clearSyslog.md
https://vuldb.com/?ctiid.307373
https://vuldb.com/?id.307373
https://vuldb.com/?submit.563430
https://www.totolink.net/

Get alerted when CVE-2025-4269 or the next vulnerability affects your stack