CVE-2025-67187
Stack-Based Buffer Overflow in TOTOLINK A950RG Firewall Module
Publication date: 2026-02-03
Last updated on: 2026-02-10
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | a950rg_firmware | 4.1.2cu.5204_b20210112 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "This vulnerability is a stack-based buffer overflow found in the TOTOLINK A950RG router firmware version V4.1.2cu.5204_B20210112. It occurs in the setIpQosRules interface within the /lib/cste_modules/firewall.so file. The issue arises because the 'comment' parameter is not properly validated for its length, allowing an attacker to overflow the buffer on the stack."}] [1]
How can this vulnerability impact me? :
A stack-based buffer overflow can allow an attacker to execute arbitrary code, crash the device, or cause denial of service. Exploiting this vulnerability could enable an attacker to gain unauthorized control over the affected TOTOLINK A950RG device, potentially compromising network security and stability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking for the presence of the vulnerable TOTOLINK A950RG firmware version and monitoring the setIpQosRules interface for suspicious activity related to the comment parameter.
Specific commands or scripts to detect exploitation attempts or the vulnerable interface are not explicitly provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps are not detailed in the provided information.
General best practices would include updating the device firmware to a version where this vulnerability is fixed, restricting access to the vulnerable interface, and monitoring network traffic for abnormal behavior related to the setIpQosRules interface.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know