CVE-2025-67445 - Vulnerability Analysis

Overview

TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability caused by insufficient bounds checking of CONTENT_LENGTH in /cgi-bin/cstecgi.cgi, letting attackers crash the management CGI and disrupt web interface availability, exploit requires sending a crafted large POST request when lighttpd request size limit is not enforced.

Severity & Score

Impact

Attackers can crash the management CGI causing denial of service and loss of web interface availability.

Mitigation

Update to the latest version with enforced request size limits or patches addressing this issue.

References

• http://totolink.com
• https://github.com/DaRkSpOoOk/CVE-2025-67445

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🟠 CVE-2025-67445 - High (7.5) TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variable and allocates memory using malloc (CONTENT_LENGTH + 1) without sufficient bounds chec... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-67445/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

GitHub Repositories(1 repo)

• https://github.com/DaRkSpOoOk/CVE-2025-67445

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner