PT-2025-16556

CVE-2025-3667

Published

2025-04-15

Updated

2025-04-16

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TOTOLINK A3700R version 9.1.2u.5822 B20200513

Description A critical issue affects the setUPnPCfg function of the file /cgi-bin/cstecgi.cgi, leading to improper access controls. The manipulation can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond.

Recommendations As a temporary workaround, consider disabling the setUPnPCfg function until a patch is available. Restrict access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Yhryhryhr_Tutu

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-266: Incorrect Privilege Assignment

Related identifiers

CVE-2025-3667