CVE-2025-1852
Published: 03 March 2025
Summary
CVE-2025-1852 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink Ex1800T Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-1852 by requiring timely identification, reporting, and patching of the buffer overflow flaw in the loginAuth function.
Prevents exploitation of the buffer overflow by enforcing validation of the password argument in the /cgi-bin/cstecgi.cgi loginAuth function.
Mitigates successful buffer overflow exploitation through memory protections like address space layout randomization and data execution prevention.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in the public-facing web CGI loginAuth function (/cgi-bin/cstecgi.cgi) enables remote exploitation of a public-facing application for potential code execution.
NVD Description
A vulnerability has been found in Totolink EX1800T 9.1.0cu.2112_B20220316 and classified as critical. This vulnerability affects the function loginAuth of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. The attack can be initiated remotely. The…
more
exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-1852 is a critical buffer overflow vulnerability (CWE-119, CWE-120) in the Totolink EX1800T router's firmware version 9.1.0cu.2112_B20220316. The flaw affects the loginAuth function in the /cgi-bin/cstecgi.cgi file, where manipulation of the password argument triggers the overflow. Published on 2025-03-03, it carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability enables remote exploitation over the network by an attacker with low privileges. No user interaction is needed, allowing low-complexity attacks that compromise confidentiality, integrity, and availability to a high degree, potentially leading to full system control.
Advisories on VulDB (ctiid.298120, id.298120) and a GitHub repository (watermelon-happy/cve/ex1800tCVE.md) document the issue, with a public exploit disclosed that may be used. The Totolink vendor site (totolink.net) should be checked for patches or firmware updates.
The exploit's public availability increases the risk of active exploitation in the wild.
Details
- CWE(s)