A vulnerability, which was classified as critical, has been found in TOTOLINK A3700R 9.1.2u.5822_B20200513. This issue affects the function setWiFiEasyCfg/setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component Password Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setWiFiEasyCfg-1cb53a41781f809f807efe1284f5eb1a?pvs=4 | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.304841 | Permissions Required |
| https://vuldb.com/?id.304841 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.551295 | Third Party Advisory VDB Entry |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
12 May 2025, 19:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setWiFiEasyCfg-1cb53a41781f809f807efe1284f5eb1a?pvs=4 - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.304841 - Permissions Required | |
| References | () https://vuldb.com/?id.304841 - Third Party Advisory, VDB Entry | |
| References | () https://www.totolink.net/ - Product | |
| References | () https://vuldb.com/?submit.551295 - Third Party Advisory, VDB Entry | |
| CPE | cpe:2.3:o:totolink:a3700r_firmware:9.1.2u.5822_b20200513:*:*:*:*:*:*:* cpe:2.3:h:totolink:a3700r:-:*:*:*:*:*:*:* |
|
| First Time |
Totolink a3700r Firmware
Totolink Totolink a3700r |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
| CWE | NVD-CWE-noinfo |
16 Apr 2025, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-16 03:15
Updated : 2025-05-12 19:50
NVD link : CVE-2025-3663
Mitre link : CVE-2025-3663
JSON object : View
Products Affected
totolink
- a3700r_firmware
- a3700r
CWE