CVE-2025-3667: TOTOLINK A3700R cstecgi.cgi setUPnPCfg access control
A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3667?
CVE-2025-3667 is classified as a critical vulnerability.
How do I fix CVE-2025-3667?
To fix CVE-2025-3667, update the TOTOLINK A3700R firmware to the latest version that addresses this vulnerability.
What type of access does CVE-2025-3667 allow?
CVE-2025-3667 allows improper access controls, which can potentially lead to unauthorized remote attacks.
Which device is affected by CVE-2025-3667?
CVE-2025-3667 affects the TOTOLINK A3700R router.
Where in the software does CVE-2025-3667 occur?
CVE-2025-3667 occurs in the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi.