What’s Vulnerable › Vulnerabilities

CVE-2025-67188

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The issue resides in the setRadvdCfg interface of the /lib/cste_modules/ipv6.so module. The function fails to properly validate the length of the user-controlled radvdinterfacename parameter, allowing remote attackers to trigger a stack buffer overflow.

Affected products

• TOTOLINK A950Rg Firmware: 4.1.2cu.5204_b20210112

References

• https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-ipv6-setRadvdCfg-radvdinterfacename-buffer.md

Get alerted when CVE-2025-67188 or the next vulnerability affects your stack