Vulnerability · Published Oct 27, 2025 · Assigned by VulDB
CVE-2025-12240TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflow
High 8.8
In plain English
A high-severity buffer overflow in A3300R from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A security vulnerability has been detected in TOTOLINK A3300R 17.0.0cu.557_B20221024. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Affected products (as reported)
Weakness: CWE-120, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
References
- VDB-329910 | TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflow vdb-entry, technical-description
- VDB-329910 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #673722 | TOTOLINK A3300R V17.0.0cu.557_B20221024 Buffer Overflow third-party-advisory
- https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setDmzCfg.md exploit
- https://www.totolink.net/ product