CVE-2025-12258
Published: 27 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-12258 is a stack-based buffer overflow vulnerability affecting the TOTOLINK A3300R router on firmware version 17.0.0cu.557_B20221024. The flaw resides in the setOpModeCfg function within the /cgi-bin/cstecgi.cgi file, part of the POST Parameter Handler component. Exploitation occurs through manipulation of the "opmode" argument, as documented with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWEs CWE-119 and CWE-121. The vulnerability was published on 2025-10-27.
Attackers with low privileges (PR:L) can exploit this remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), potentially enabling remote code execution via the buffer overflow.
Advisories and additional details, including a proof-of-concept, are available via VulDB entries (vuldb.com/?ctiid.329929, vuldb.com/?id.329929, vuldb.com/?submit.673725) and a GitHub repository (github.com/noahze01/IoT-vulnerable/blob/main/TOTOLink/A3300R/setOpModeCfg.md). The vendor website (www.totolink.net) should be consulted for any patches or firmware updates.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes a remotely exploitable stack-based buffer overflow in the public-facing web CGI interface (/cgi-bin/cstecgi.cg) of the TOTOLINK A3300R router via the 'opmode' POST parameter, directly enabling exploitation of a public-facing application.