CVE-2025-9303CRITICAL 9.8EPSS p50.8%

CVE-2025-9303CVE-2025-9303

Description

A security flaw has been discovered in TOTOLINK A720R 4.1.5cu.630_B20250509. This issue affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. Performing manipulation of the argument desc results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.77% probability of exploitation · percentile 50.8% · 2026-06-19T12:03:05Z
Published2025-08-21
Last modified2025-10-06

Underlying weaknesses· 2

CWE-119CWE-120

References

  1. https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md
  2. https://github.com/lin-3-start/lin-cve/blob/main/TOTOLINK%20A720R/TOTOLINK-A720R.md#poc
  3. https://vuldb.com/?ctiid.320908
  4. https://vuldb.com/?id.320908
  5. https://vuldb.com/?submit.632410
  6. https://www.totolink.net/

2

TypeTargetConfidenceTier
WeaknessImproper Restriction of Operations within the Bounds of a Memory Buffercwe-1190%live
WeaknessBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')cwe-1200%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-12240
CVE
CVE-2025-12258
CVE
CVE-2025-12260
CVE
CVE-2025-12239
CVE
CVE-2025-5903
CVE
CVE-2025-12241
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.