CVE-2025-2370 is a high severity stack-based buffer overflow (CVSS 8.8) in the TOTOLINK EX1800T Wi-Fi extender, up to firmware 9.1.0cu.2112_B20220316, in the setWiFiExtenderConfig function. The record lists no fixed version. Check TOTOLINK for newer firmware, limit access to the admin interface, and replace the device if none appears.
What's affected
The NVD record names the TOTOLINK EX1800T up to and including firmware 9.1.0cu.2112_B20220316. The affected function is setWiFiExtenderConfig in /cgi-bin/cstecgi.cgi, where the apcliSsid argument leads to a stack-based buffer overflow. The description says the exploit has been disclosed to the public and may be used. The record is not on the CISA Known Exploited Vulnerabilities list.
The weaknesses are classed as CWE-119 (improper restriction of operations within the bounds of a memory buffer), CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write). The score is 8.8 (HIGH). The vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reads as reachable over the network, low attack complexity, low privileges required and no user interaction. Impact is high on confidentiality, high on integrity and high on availability. The record was published on 2025-03-17.
No fixed firmware is listed in the record. Check the TOTOLINK download page for your exact hardware revision and read its release notes. If the newest firmware is the same as the listed one, treat the device as unpatched.
How to check if you're exposed
Extenders are easy to lose track of. Use this short routine.
- Find the device. Check the label for the model name EX1800T and look for it in your router or DHCP client list.
- Open its admin page from a trusted machine and read the firmware version on the status page. Compare it with 9.1.0cu.2112_B20220316.
- Confirm the admin interface is not reachable from the internet and that no port forwarding points at it.
- Note who holds the admin login. The vector shows low privileges are needed, so a shared or default password widens the risk.
If you cannot sign in to read the version, assume it is affected.
What to do now
- Locate every EX1800T and record its firmware version.
- Check the vendor site for newer firmware and apply it if it is available. Read the notes to see whether this CVE is named.
- Change the admin password to a long unique one, and remove any port forwarding or remote management to the device.
- Keep the extender on a network segment away from servers and sensitive workstations.
- If no fix exists, replace the extender with a supported model.
Why it matters
A stack-based buffer overflow, listed as CWE-119, CWE-121 and CWE-787, happens when code copies input into a fixed size area on the stack without checking the length. Extra data spills past the end and can overwrite nearby memory, which can crash the program or, in the worst case, change what it runs. The record scores confidentiality, integrity and availability impact as high for that reason.
These bugs are old and well understood, and embedded firmware keeps repeating them because of unchecked string handling in CGI programs. The fix in code is a length check or a bounded copy. For you, as a device owner, the fix is whatever the vendor ships, which is why firmware tracking matters.
If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.
Quick check
Why does the same product have two CVEs?
Each CVE names a different function and argument in the same CGI program. Fixing one bounds check does not fix the others, so a firmware update should address all of them, and its notes should say so.
Is CVE-2025-2370 used in attacks?
The record is not on the CISA Known Exploited Vulnerabilities list, and I found no advisory saying so. It does say a public exploit write-up exists, so do not rely on that for comfort.
Sources
- Safeguard Gold entry for CVE-2025-2370
- NVD record data for CVE-2025-2370 (published 2025-03-17)
- Reference listed in the CVE record
- Reference listed in the CVE record
Last reviewed: 19 October 2026.
