CVE Intelligence
Analysis AI-assisted

CVE-2025-67186: TOTOLINK A950RG Buffer Overflow in setUrlFilterRules

CVE-2025-67186 is a buffer overflow in the setUrlFilterRules interface of the firewall.so module in TOTOLINK A950RG firmware V4.1.2cu.5204_B20210112. The record describes a missing length check on the url parameter, and the NVD CVSS 3.1 base score is 9.8 (critical). No confirmed exploitation appears in the sources consulted, and no fixed version is listed in the record.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-67186 affects the setUrlFilterRules interface in /lib/cste_modules/firewall.so, part of TOTOLINK A950RG firmware V4.1.2cu.5204_B20210112. The record states that the url parameter is not properly validated for length, which matches the CWE-120 classic buffer overflow classification.

Impact

  • The record states that remote attackers may trigger the buffer overflow.
  • The record states the overflow could potentially lead to arbitrary code execution or denial of service.
  • NVD assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges and no user interaction.

Affected products and versions

  • Product in the record: Totolink A950rg Firmware.
  • Version in the record: 4.1.2cu.5204_b20210112 (the firmware is written as V4.1.2cu.5204_B20210112 in the description).
  • The record lists no other affected versions and no fixed versions.

Exploitation status

The CISA KEV catalog entry is not listed for this CVE in the record, so no confirmed active exploitation is reported there. No confirmed exploitation appears in the sources consulted. The record includes a third-party GitHub reference tagged as Exploit; this analysis does not describe its contents, and that tag alone does not establish exploitation in the wild.

Remediation and mitigation

  • The record lists no fix. Check with TOTOLINK or the device supplier for firmware updates that address this issue.
  • Until a vendor fix is confirmed, restrict access to the device management interface and avoid exposing it to untrusted networks.
  • Isolate affected routers in segments where a compromise would have limited reach, and plan replacement if no update is available.
  • Review whether the device is in use in your environment before assuming it is patched.

Detection guidance

  • Inventory TOTOLINK A950RG devices and their firmware versions.
  • Monitor for unexpected restarts, crashes or service interruptions on these devices, which could indicate abnormal input handling.
  • Review logs of the device management interface for unusual or malformed requests where logging is available.

Limitations of the available information

  • The record provides no EPSS score, no SSVC data and no vendor advisory from TOTOLINK.
  • The record does not state whether other firmware versions are affected.
  • No fixed version or patch is listed, which is not the same as confirming that no fix exists.
  • Technical details beyond the record description were not available for this analysis.

Frequently asked questions

Is CVE-2025-67186 being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. A third-party reference is tagged as Exploit, but that tag does not by itself confirm exploitation.

Is there a fixed firmware version?

The record lists no fixed version. Contact TOTOLINK or the device supplier to confirm whether an update exists.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.