A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setUPnPCfg-1cb53a41781f802b8b16f973366ee5e3?pvs=4 | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.304845 | Permissions Required |
| https://vuldb.com/?id.304845 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.551299 | Third Party Advisory VDB Entry |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
12 May 2025, 19:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://vuldb.com/?id.304845 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.551299 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?ctiid.304845 - Permissions Required | |
| References | () https://lavender-bicycle-a5a.notion.site/TOTOLINK-A3700R-setUPnPCfg-1cb53a41781f802b8b16f973366ee5e3?pvs=4 - Exploit, Third Party Advisory | |
| References | () https://www.totolink.net/ - Product | |
| First Time |
Totolink a3700r Firmware
Totolink Totolink a3700r |
|
| CPE | cpe:2.3:o:totolink:a3700r_firmware:9.1.2u.5822_b20200513:*:*:*:*:*:*:* cpe:2.3:h:totolink:a3700r:-:*:*:*:*:*:*:* |
|
| CWE | NVD-CWE-noinfo |
16 Apr 2025, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-16 05:15
Updated : 2025-05-12 19:49
NVD link : CVE-2025-3667
Mitre link : CVE-2025-3667
JSON object : View
Products Affected
totolink
- a3700r_firmware
- a3700r
CWE