CVE-2025-2370
Published: 17 March 2025
Summary
CVE-2025-2370 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Totolink Ex1800T Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of the apcliSsid input to prevent stack-based buffer overflow in the setWiFiExtenderConfig function.
Enforces memory protections like stack canaries and non-executable memory to block exploitation of the stack-based buffer overflow.
Mandates timely flaw remediation via firmware patching to eliminate the buffer overflow vulnerability in cstecgi.cgi.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stack-based buffer overflow in public-facing CGI endpoint (/cgi-bin/cstecgi.cgi) enables remote arbitrary code execution on the router with low privileges, directly mapping to exploitation of public-facing applications for initial access and device compromise.
NVD Description
A vulnerability was found in TOTOLINK EX1800T up to 9.1.0cu.2112_B20220316. It has been declared as critical. Affected by this vulnerability is the function setWiFiExtenderConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument apcliSsid leads to stack-based buffer overflow. The…
more
attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-2370 is a critical stack-based buffer overflow vulnerability affecting TOTOLINK EX1800T router firmware versions up to 9.1.0cu.2112_B20220316. The flaw exists in the setWiFiExtenderConfig function of the /cgi-bin/cstecgi.cgi component, where manipulation of the apcliSsid argument triggers the overflow. It is associated with CWEs-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), CWE-121 (Stack-based Buffer Overflow), and CWE-787 (Out-of-bounds Write), and carries a CVSS v3.1 base score of 8.8.
The vulnerability enables remote exploitation by an attacker with low privileges over the network. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), it requires low attack complexity, no user interaction, and unchanged scope, allowing high impacts on confidentiality, integrity, and availability. This could result in arbitrary code execution or device compromise.
VulDB advisories (ctiid.299869, id.299869, submit.515329) document the issue and note that an exploit has been publicly disclosed. A proof-of-concept is available on GitHub at https://github.com/kn0sky/cve/blob/main/TOTOLINK%20EX1800T/Stack-based%20Buffer%20Overflow%2003%20setWiFiExtenderConfig-_apcliSsid.md, which may facilitate active attacks. The vendor site at https://www.totolink.net/ provides general support, but no specific patch details are outlined in the references.
Details
- CWE(s)