A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
References
| Link | Resource |
|---|---|
| https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/showSyslog.md | Exploit |
| https://vuldb.com/?ctiid.307375 | Permissions Required VDB Entry |
| https://vuldb.com/?id.307375 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.563444 | Third Party Advisory VDB Entry |
| https://www.totolink.net/ | Product |
Configurations
Configuration 1 (hide)
| AND |
|
History
07 May 2025, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://vuldb.com/?ctiid.307375 - Permissions Required, VDB Entry | |
| References | () https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/showSyslog.md - Exploit | |
| References | () https://vuldb.com/?submit.563444 - Third Party Advisory, VDB Entry | |
| References | () https://www.totolink.net/ - Product | |
| References | () https://vuldb.com/?id.307375 - Third Party Advisory, VDB Entry | |
| CWE | NVD-CWE-noinfo | |
| First Time |
Totolink a720r Firmware
Totolink Totolink a720r |
|
| CPE | cpe:2.3:h:totolink:a720r:-:*:*:*:*:*:*:* cpe:2.3:o:totolink:a720r_firmware:4.1.5cu.374:*:*:*:*:*:*:* |
05 May 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-05 08:15
Updated : 2025-05-07 16:38
NVD link : CVE-2025-4271
Mitre link : CVE-2025-4271
JSON object : View
Products Affected
totolink
- a720r_firmware
- a720r
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
NVD-CWE-noinfo CWE-284Improper Access Control