CVE-2025-2369
Published: 17 March 2025
Summary
CVE-2025-2369 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink Ex1800T Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 39.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-2369 is a critical stack-based buffer overflow vulnerability affecting TOTOLINK EX1800T routers running firmware versions up to 9.1.0cu.2112_B20220316. The issue resides in the setPasswordCfg function within the /cgi-bin/cstecgi.cgi component, where improper handling of the 'admpass' argument allows overflow. Rated at CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it maps to CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write).
Attackers with low privileges, such as authenticated users, can exploit this remotely with low complexity and no user interaction required. Successful exploitation grants high-impact confidentiality, integrity, and availability violations, potentially enabling arbitrary code execution on the device. A public proof-of-concept exploit has been disclosed, increasing the risk of widespread abuse.
Advisories from VulDB detail the vulnerability (ctiid.299868, id.299868) and reference a submission entry, while a GitHub repository provides an exploit markdown for the setPasswordCfg 'admpass' overflow. The vendor's site at totolink.net should be consulted for any firmware updates or mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6641
Vulnerability details
A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been classified as critical. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument admpass leads to stack-based buffer overflow. It is possible to…
more
launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The stack-based buffer overflow in the unauthenticated web CGI interface (setPasswordCfg) of the TOTOLINK EX1800T router enables remote exploitation of a public-facing application (T1190) for RCE/shell access and can cause DoS via application/system crash (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the 'admpass' argument in setPasswordCfg to prevent stack-based buffer overflow from oversized or malformed inputs.
Implements memory protections such as stack canaries, ASLR, and non-executable stacks to mitigate exploitation of the stack-based buffer overflow.
Mandates timely remediation of the identified buffer overflow flaw through firmware updates for the TOTOLINK EX1800T router.