CVE-2025-4496: High Buffer Overflow in TOTOLINK Routers

CVE-2025-4496 is a high severity buffer overflow (CVSS 8.8) in several TOTOLINK routers running firmware 4.1.8cu.5241_B20210927. The CloudACMunualUpdate function in /cgi-bin/cstecgi.cgi mishandles the FileName argument. No fix is listed, so check TOTOLINK for newer firmware and restrict the admin interface.

What's affected

Per the CVE record, the affected models are the TOTOLINK T10, A3100R, A950RG, A800R, N600R, A3000RU and A810R, all on firmware version 4.1.8cu.5241_B20210927. The vulnerable function is CloudACMunualUpdate in the web management binary at /cgi-bin/cstecgi.cgi. The FileName argument can overflow a buffer.

The attack is network based and needs low privileges, which is why the vector reads PR:L. The CVSS impact is high for confidentiality, integrity and availability.

The record does not name a fixed firmware version. The only vendor reference is the TOTOLINK home page, plus a public write up on GitHub. I did not retrieve either, so check the TOTOLINK download page for your exact model and look at the release notes before you trust any build to include a fix.

The record says an exploit has been disclosed publicly. It does not report attacks in the wild, and the KEV flag is false.

How to check if you're exposed

Log in to the router's admin page and find the firmware version, usually under system or upgrade settings. If it matches 4.1.8cu.5241_B20210927 on one of the listed models, it is in scope.

Then check whether the management interface is reachable from outside. From a machine outside your network, a port scan of your public address should show no admin web port open. From inside, you can check your own router like this:

nmap -p 80,443,8080 <router-address>

Run this only against devices you own. Also look at the router settings for remote management, cloud features and port forwarding, and turn off any you do not need.

Small offices and branch sites often run consumer grade routers that nobody tracks. Walk through your asset list, and look at purchase records for these model names.

What to do now

1. Identify every TOTOLINK router of the listed models and read its firmware version.
2. Check the TOTOLINK support page for newer firmware for each model, and install it if the release notes address this issue or are newer than the affected build.
3. Turn off remote administration, and make sure the admin page is not forwarded to the internet.
4. Change the admin password to a long unique one, since the attack needs a login of some kind.
5. Put the router admin page on a management VLAN or limit it to one trusted host.
6. If no fix is published and the device is exposed or critical, plan a replacement with a vendor that publishes security updates.
7. Record the devices in your inventory, with model, firmware and owner.

Why it matters

The record maps the issue to CWE-119 and CWE-120. In short, the code copies input into a fixed size buffer without checking its length. That can crash the service, or in the worse case let an attacker run their own code on the router.

CGI binaries in router firmware have a long record of this class of bug. They are written in C, run with high privileges, and are slow to receive fixes. A router compromise gives an attacker a view of everything that crosses it.

Router firmware rarely appears in a software bill of materials, which is why it gets missed. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers the code you ship. For devices, rely on your asset list and the Gold directory to look up CVEs by vendor.

Quick check

Sources

• CVE-2025-4496 on Gold
• NVD record for CVE-2025-4496
• Reference URLs listed in the CVE record: a public GitHub write up, VulDB entries and the TOTOLINK site. They were not retrieved when this post was written.

Last reviewed: 18 October 2026.