CVE-2025-4270

TOTOLINK A720R Config cstecgi.cgi information disclosure

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.15.3Medium EPSS percentile96th13% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixVendor fixNo build named by the sources

Published 2025-05-05Updated 2025-05-07Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check your router’s firmware version and confirm whether it matches TOTOLINK A720R 4.1.5cu.374 (and/or “a720r firmware” variants your device reports).
If you’re on an affected version, update to the vendor’s latest firmware that addresses this /cgi-bin/cstecgi.cgi information disclosure (ask your router vendor if you can’t find release notes).
Restrict access to the router from the internet: ensure administrative/CGI endpoints are not reachable from the public internet (use network rules/firewalling or router “remote management” off).
Add or enable web-application–aware filtering (a WAF or similar reverse-proxy protection) so unsolicited requests to unusual CGI parameters are blocked.
If you cannot patch immediately, treat the device as internet-exposed only if necessary: limit inbound traffic to only what your business uses (whitelisting), and block all other inbound to the router.

Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

In plain language

Written by AI from the record

If you use a TOTOLINK A720R router, a remote attacker may be able to view parts of your router configuration without logging in—so you should check whether you’re on the affected firmware and limit internet access to the device.

Unauthenticated remote information disclosure in TOTOLINK A720R’s /cgi-bin/cstecgi.cgi (Config Handler) allows attackers to retrieve sensitive configuration data by manipulating the topicurl argument (e.g., getInitCfg/getSysStatusCfg).

If you're affected

Leaked router configuration details
Privacy exposure of device settings
Potential follow-on attacks
Configuration tampering risk

What is it

This bug is like leaving a notebook of your router’s settings accessible through a hidden door. Attackers don’t need an account to try it, and they can request specific details that reveal configuration information.

Who is affected

This matters if you run or administer a TOTOLINK A720R router (including “a720r firmware”) and your device is reachable from the internet. The reported issue does not require a login or user action, so exposure depends mainly on whether the vulnerable endpoint can be contacted remotely. Only a risk if the device’s affected web/CGI functionality is reachable from the internet in your deployment.

How urgent is it

Treat this as an Amber issue: it’s a remote, no-login information leak, and the vulnerability has a public proof-of-concept. While it’s not confirmed to be a known CISA KEV active case, the combination of remote reachability and public exploit code means you should patch or strongly restrict access promptly.

What to do — in detail

Confirm whether you’re affected

On the affected router (TOTOLINK A720R), check the firmware version shown in the device UI or device label.
Compare it to the known affected version called out in the findings: TOTOLINK A720R 4.1.5cu.374. If your firmware matches, assume you’re exposed to the /cgi-bin/cstecgi.cgi information disclosure issue.

Upgrade path (preferred)

Contact TOTOLINK support or check for the latest firmware for the TOTOLINK A720R line and apply the release that fixes CVE-2025-4270.
After upgrading, verify in the router UI that the firmware version changed and re-check that remote management/CGI access is still restricted as intended.

If patching is delayed (workarounds)

Block direct internet access to the router’s web/CGI endpoints:
- Disable any “remote management” feature.
- Ensure no port-forwarding exposes the router’s web interface to the public internet.
- If you must access it from outside, require a VPN or tightly controlled access (instead of open inbound).
Use web-application filtering in front of the router (where feasible):
- Enable a WAF or deploy a reverse-proxy/Web gateway that blocks requests with unusual CGI parameters (for example, requests targeting /cgi-bin/cstecgi.cgi and the topicurl argument patterns).
Whitelist only the business-required inbound traffic and drop everything else.

What to monitor

Look for repeated inbound requests to the router that match CGI-style paths (especially /cgi-bin/cstecgi.cgi) and odd query parameters.
Confirm whether your ISP/router logs show external scanning activity, and tighten firewall rules if you see attempts from the internet.

CISA due date

No CISA KEV listing was provided for this CVE, so no KEV due date applies based on the supplied findings.

Technical context

CVE-2025-4270 is an information disclosure flaw (CWE-200 / CWE-284) in TOTOLINK A720R’s /cgi-bin/cstecgi.cgi (Config Handler). The findings state that a remote attacker can read sensitive configuration data without authentication by manipulating the topicurl argument, including inputs described as getInitCfg/getSysStatusCfg. Public proof-of-concept code exists (2 known) and the likelihood estimate is rising, but there is no KEV listing in the provided findings—so active exploitation is not confirmed here. This is consistent with an attack model where the device’s CGI endpoint is reachable from the internet (reachable-in-default-config is unknown), and attackers do not need user interaction or credentials.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

13% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 303 days before any public exploit.

2026-07-05EPSS band change0 → moderateepss band change
2026-03-07Public exploit / PoCsource: github-poc
2025-05-07Patch availablerecord updated
2025-05-05Publishedweakness classified, att&ck mapped

Affected products

TOTOLinkcommercial · TWaka totolink corp.
- A720RNetworking Infrastructure
- a720r firmwareNetworking Infrastructure

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability NoneNo availability impact