CVE-2025-4269: totolink a720r_firmware Incorrect Privilege Assignment

Vulnerability summary

CVE-2025-4269 is a medium (CVSS 6.9) Incorrect Privilege Assignment vulnerability in totolink a720r_firmware. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-05-2025
   PublishedVulnerability first disclosed.
2. 05-05-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/cstecgi.cgi of the component Log Handler. The manipulation of the argument topicurl with the input clearDiagnosisLog/clearSyslog/clearTracerouteLog leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.