Vulnerability · Published Oct 27, 2025 · Assigned by VulDB

CVE-2025-12260TOTOLINK A3300R POST Parameter cstecgi.cgi setSyslogCfg stack-based overflow

High 8.8

In plain English

A high-severity stack buffer overflow in A3300R from TOTOLINK. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 36.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in TOTOLINK A3300R 17.0.0cu.557_B20221024. The impacted element is the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi of the component POST Parameter Handler. Such manipulation of the argument enable leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
TOTOLINK	A3300R	17.0.0cu.557_B20221024

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-329931 | TOTOLINK A3300R POST Parameter cstecgi.cgi setSyslogCfg stack-based overflow vdb-entry, technical-description
VDB-329931 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #673727 | TOTOLINK A3300R V17.0.0cu.557_B20221024 Buffer Overflow third-party-advisory
https://github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setSyslogCfg.md exploit
https://www.totolink.net/ product