CVE-2025-1340
Published: 16 February 2025
Summary
CVE-2025-1340 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink X18 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Validates and sanitizes user-supplied strings in the setPasswordCfg CGI function to prevent stack-based buffer overflows from crafted inputs.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the stack-based buffer overflow even if invalid input reaches the vulnerable function.
Establishes processes for timely remediation of flaws like the buffer overflow in TOTOLINK X18 firmware to eliminate the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the public-facing router web CGI interface (/cgi-bin/cstecgi.cgi#setPasswordCfg) is remotely exploitable for RCE or DoS, enabling T1190 (Exploit Public-Facing Application) and T1499.004 (Application or System Exploitation).
NVD Description
A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely.…
more
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-1340 is a critical stack-based buffer overflow vulnerability in the TOTOLINK X18 router firmware version 9.1.0cu.2024_B20220329. The flaw affects the setPasswordCfg function in the /cgi-bin/cstecgi.cgi file, where string manipulation triggers the overflow. It is classified under CWE-119, CWE-121, and CWE-787, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An authenticated attacker with low privileges can exploit this vulnerability remotely by sending a specially crafted string to the affected endpoint. Successful exploitation allows arbitrary code execution, potentially leading to full compromise of the device with high impacts on confidentiality, integrity, and availability.
Advisories from VulDB and a GitHub repository document the issue, including proof-of-concept exploit details, and note that the vendor was contacted prior to public disclosure but has not responded. No patch or mitigation is available from TOTOLINK as of the CVE publication on 2025-02-16; practitioners should isolate affected devices and monitor the vendor site for updates. The exploit has been publicly disclosed and may be used in attacks.
Details
- CWE(s)