CVE-2025-3674: totolink a3700r_firmware Incorrect Privilege Assignment

Vulnerability summary

CVE-2025-3674 is a medium (CVSS 6.9) Incorrect Privilege Assignment vulnerability in totolink a3700r_firmware. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.5% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 16-04-2025
   PublishedVulnerability first disclosed.
2. 16-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822_B20200513. It has been declared as critical. Affected by this vulnerability is the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.