CVE-2025-1340
Published: 16 February 2025
Summary
CVE-2025-1340 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink X18 Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
A stack-based buffer overflow vulnerability exists in the TOTOLINK X18 router running firmware version 9.1.0cu.2024_B20220329. The flaw resides in the setPasswordCfg function within /cgi-bin/cstecgi.cgi, where improper handling of string input allows an attacker to overwrite the stack. It is tracked as CVE-2025-1340, carries a CVSS 4.0 score of 8.7, and is associated with CWE-119, CWE-121, and CWE-787.
An authenticated remote attacker can send a crafted request to the CGI endpoint to trigger the overflow. Successful exploitation grants the ability to execute arbitrary code or cause a denial of service on the device, with impacts spanning confidentiality, integrity, and availability.
Public references include a detailed disclosure on GitHub, multiple VulDB entries, and the vendor’s site. The vendor was notified prior to disclosure but provided no response or patch, leaving the exploit code publicly available for use.
The EPSS score reached a peak of 0.0190 after disclosure before settling at the current value of 0.0112, indicating modest post-publication interest in the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2111
Vulnerability details
A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely.…
more
The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in the public-facing router web CGI interface (/cgi-bin/cstecgi.cgi#setPasswordCfg) is remotely exploitable for RCE or DoS, enabling T1190 (Exploit Public-Facing Application) and T1499.004 (Application or System Exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates and sanitizes user-supplied strings in the setPasswordCfg CGI function to prevent stack-based buffer overflows from crafted inputs.
Implements memory protections such as stack canaries, ASLR, and DEP to mitigate exploitation of the stack-based buffer overflow even if invalid input reaches the vulnerable function.
Establishes processes for timely remediation of flaws like the buffer overflow in TOTOLINK X18 firmware to eliminate the vulnerability.