Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-63821 — Proof-of-concept of vulnerability found in Totolink A720R router | Kitploit
Tools/GitHubGitHub/xernary/cve-2025-63821
Embedded Systems SecurityIoT SecurityVulnerability AnalysisExploitationWeb Application ExploitationFirmware Analysis
GitHubxernary/cve-2025-63821

CVE-2025-63821

Proof-of-concept of vulnerability found in Totolink A720R router

View Repository
42 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-63821

Submitter: Nicola Giuffrida

Information

Vendor: TOTOLINK
Vendor's website: TOTOLINK
Model: A720R
Firmware version: V4.1.5cu.630_B20250509
Firmware download address: TOTOLINK

Severity

CVSS v4.0 Base Score: 4.8 (Medium)
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Vulnerability details

Insufficient sanitization from Validity_check function leads to argument injection in setDiagnosisCfg and setTracerouteCfg components.

The vulnerable code is found in FUN_0041f1ac() and FUN_0041f0e4() of the cstecgi.cgi firmware binary; in both functions the ip_addr buffer is populated directly from an HTTP request parameter:

Injecting the '#' character in the ip address field of the Diagnosis function via crafted HTTP request leads to the "Diagnosis" button becoming unresponsive, making such function indefinitely unavailable:

Injecting arbitrary arguments using the '-' character in the ip address field of the Route Tracking function (or Diagnosis function) via crafted HTTP request leads to argument injection:

Download Tool