CVE-2025-67187
Published: 03 February 2026
Summary
CVE-2025-67187 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Totolink A950Rg Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 46.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of input parameters like the oversized comment field to prevent stack-based buffer overflows in the setIpQosRules interface.
Implements memory protections such as stack canaries to mitigate exploitation of stack-based buffer overflows even if input validation fails.
Mandates timely identification, reporting, and correction of flaws like this buffer overflow vulnerability through firmware patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a stack-based buffer overflow in the web interface (setIpQosRules) of a public-facing router, exploitable remotely without authentication for arbitrary code execution.
NVD Description
A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112. The flaw exists in the setIpQosRules interface of /lib/cste_modules/firewall.so where the comment parameter is not properly validated for length.
Deeper analysisAI
CVE-2025-67187 is a stack-based buffer overflow vulnerability (CWE-121) affecting the TOTOLINK A950RG router on firmware version V4.1.2cu.5204_B20210112. The flaw occurs in the setIpQosRules interface of the /lib/cste_modules/firewall.so library, where the comment parameter is not properly validated for length, enabling overflow conditions.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable by any unauthenticated attacker over the network with low complexity and no user interaction. Exploitation involves sending a crafted request with an oversized comment parameter, potentially leading to arbitrary code execution and full compromise of the affected device, including high impacts on confidentiality, integrity, and availability.
A technical analysis and proof-of-concept are detailed in the GitHub reference at https://github.com/SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-setIpQosRules-comment-buffer.md. No vendor advisories or patches are specified in the available information.
Details
- CWE(s)