CVE-2025-2688: TOTOLINK A3000RU Syslog Configuration File ExportSyslog.sh access control
A vulnerability classified as problematic was found in TOTOLINK A3000RU up to 5.9c.5185. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ExportSyslog.sh of the component Syslog Configuration File Handler. The manipulation leads to improper access controls. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TOTOLINK A3000RUto a version that resolves this vulnerability.Fixed in 5.9c.5185 - Compensating control
Because the attack must be performed within the local network, restrict access to the device’s syslog configuration/export functionality (including /cgi-bin/ExportSyslog.sh) to trusted/local admin sources only (e.g., limit access via LAN network segmentation/ACL so only authorized management hosts can reach it).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2688?
CVE-2025-2688 is classified as problematic due to its improper access control vulnerability.
How do I fix CVE-2025-2688?
To mitigate CVE-2025-2688, update the TOTOLINK A3000RU firmware to the latest version beyond 5.9c.5185.
What components are affected by CVE-2025-2688?
CVE-2025-2688 affects the Syslog Configuration File Handler found in the /cgi-bin/ExportSyslog.sh file.
Is CVE-2025-2688 actively exploited?
There is currently no public knowledge of active exploitation of CVE-2025-2688.
Who is responsible for addressing CVE-2025-2688?
It is the responsibility of the users of the TOTOLINK A3000RU to address and remediate CVE-2025-2688.