
Proof-of-concept of vulnerability found in Totolink A720R router
Vendor: TOTOLINK
Vendor's website: TOTOLINK
Model: A720R
Firmware version: V4.1.5cu.630_B20250509
Firmware download address: TOTOLINK
CVSS v4.0 Base Score: 4.8 (Medium)
Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Insufficient sanitization from Validity_check function leads to argument injection in setDiagnosisCfg and setTracerouteCfg components.
The vulnerable code is found in FUN_0041f1ac() and FUN_0041f0e4() of the cstecgi.cgi firmware binary; in both functions the ip_addr buffer is populated directly from an HTTP request parameter:


Injecting the '#' character in the ip address field of the Diagnosis function via crafted HTTP request leads to the "Diagnosis" button becoming unresponsive, making such function indefinitely unavailable:

Injecting arbitrary arguments using the '-' character in the ip address field of the Route Tracking function (or Diagnosis function) via crafted HTTP request leads to argument injection:
