Vulnerability record · CVE-2025-4270 · published 5 May 2025

CVE-2025-4270: Totolink a720r firmware information exposure vulnerability

TTotolink · A720r Firmware

A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It has been classified as problematic. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of the component Config Handler. The manipulation of the argument topicurl with the input getInitCfg/getSysStatusCfg leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

6.9 CVSS 4.0 Medium EPSS 13% · top 3.8% CWE-200 · Information exposureCWE-284 · Improper access control

6.9CVSS 4.0 base score, v2 5.0

13%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

TA720r Firmware Totolink

References

Link	Tags
https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getInitCfg.md	Exploit
https://github.com/at0de/my_vulns/blob/main/TOTOLINK/A720R/getSysStatusCfg.md	Exploit
https://vuldb.com/?ctiid.307374	Permissions RequiredVDB Entry
https://vuldb.com/?id.307374	Third Party AdvisoryVDB Entry
https://vuldb.com/?submit.563442	Third Party AdvisoryVDB Entry
https://www.totolink.net/	Product

Track CVE-2025-4270 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-23064Totolink a720r firmware incorrect authorization vulnerabilityTOTOLINK A720R V4.1.5cu.532_ B20210610 is vulnerable to Incorrect Access Control.EPSS 0.70%17 Feb 2023 9.8CVE-2021-45740Totolink a720r firmware vulnerabilityTOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a stack overflow in the setWiFiWpsStart function. This vulnerability allows attackers…EPSS 1.4%4 Feb 2022 9.8CVE-2021-45742Totolink a720r firmware command injection vulnerabilityTOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows a…EPSS 3.1%4 Feb 2022 9.8CVE-2021-44247Totolink a720r firmware command injection vulnerabilityTotolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command inje…EPSS 2.8%4 Feb 2022 9.8CVE-2021-35324Totolink a720r firmware vulnerabilityA vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication.EPSS 10%5 Aug 2021 9.8CVE-2021-35327Totolink a720r firmware missing authorization vulnerabilityA vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the default cre…EPSS 1.4%5 Aug 2021 9.8CVE-2021-27710Totolink x5000r firmware os command injection vulnerabilityCommand Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allo…EPSS 7.9%14 Apr 2021 9.8CVE-2021-27708Totolink x5000r firmware os command injection vulnerabilityCommand Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allo…EPSS 7.6%14 Apr 2021

Source: NIST National Vulnerability Database (record CVE-2025-4270), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.