CVE-2025-1340

high · 8.7

A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi. The manipulation as part of String leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

8.7

CVSS

16.7%

EPSS (exploit prob.)

97th

EPSS percentile

2025-02-16

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-119CWE-121CWE-787

Affected products

Vendor	Product	Affected versions
totolink	x18_firmware	9.1.0cu.2024_b20220329
totolink	x18	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/stevenchen0x01/CVE2/blob/main/stack_overflow.md
https://vuldb.com/?ctiid.295956
https://vuldb.com/?id.295956
https://vuldb.com/?submit.495368
https://www.totolink.net/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-1340