CVE-2025-6137: TOTOLINK T10 HTTP POST Request cstecgi.cgi setWiFiScheduleCfg buffer overflow

Published Jun 16, 2025

Updated

A vulnerability classified as critical has been found in TOTOLINK T10 4.1.8cu.5207. Affected is the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument desc leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected Software

3 affected components

TOTOLINK T10

All of the following

TOTOLINK T10 Firmware=4.1.8cu.5207_b20210320

TOTOLINK T10=2.0

Event History

Jun 16, 2025

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-6137?

CVE-2025-6137 is classified as a critical vulnerability.

What components are affected by CVE-2025-6137?

CVE-2025-6137 affects the setWiFiScheduleCfg function in the HTTP POST Request Handler of TOTOLINK T10.

How does CVE-2025-6137 exploit the system?

CVE-2025-6137 can lead to a buffer overflow through manipulation of the argument desc.

What versions of TOTOLINK T10 are impacted by CVE-2025-6137?

CVE-2025-6137 affects TOTOLINK T10 running version 4.1.8cu.5207.

How can I mitigate CVE-2025-6137?

To mitigate CVE-2025-6137, it is recommended to apply available firmware updates from TOTOLINK.