CVE-2025-45789 is a critical stack-based buffer overflow (CVSS 9.8) in TOTOLINK A3100R firmware V5.9c.1527. The weak spot is the urlKeyword parameter handled by setParentalRules. The record lists no fixed firmware, so isolate the router's web management interface, check TOTOLINK's download page for newer firmware, and replace unsupported units.
What's affected
The NVD record names one product line: TOTOLINK A3100R, firmware V5.9c.1527. The vulnerable function is setParentalRules, and the field involved is urlKeyword. The record is a short report derived from a public write-up on GitHub rather than a vendor advisory.
No fixed firmware version is stated. Do not assume that a later firmware fixes it unless TOTOLINK's release notes say so.
How to check if you're exposed
Routers do not show up in package manager queries, so check the device itself.
- Log in to the router's management page and read the firmware version on the status or system page. Compare it with V5.9c.1527.
- Confirm the exact model name on the label. The record covers A3100R only, not other TOTOLINK models.
- Test whether the management interface answers from the internet side. If you can reach it from outside your network, so can anyone else.
- Review any port forwarding, UPnP or remote administration settings that expose the web interface.
If the router is part of a product you ship or manage for others, record the firmware version in your asset inventory so the next advisory is quick to triage.
What to do now
- Identify every TOTOLINK A3100R on your network and read its firmware version.
- Turn off remote (WAN side) administration and any port forwarding to the management interface.
- Restrict management access to one trusted wired host or VLAN and change the admin password from any default.
- Check TOTOLINK's download page for firmware newer than V5.9c.1527, read its notes, and install it only from the vendor site.
- If no update exists for your hardware, plan to replace the router, especially where it sits at the edge of a business network.
- Watch the router for unexpected reboots or configuration changes, which can point to attempts against the management service.
Why it matters
The record lists CWE-121 (Stack-based Buffer Overflow), CWE-787 (Out-of-bounds Write). In short, the firmware copies the urlKeyword value into a fixed size buffer without checking its length first. Data that is longer than the buffer spills into adjacent memory, which can crash the service or change how the program runs.
On a consumer or small office router the web server usually runs with high privileges, so memory corruption in a request handler is serious. The vector (AV:N, AC:L, PR:N, UI:N) describes the worst case for reach, although whether that applies depends on who can reach the management page. The record does not mark the CVE as exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is there a firmware fix?
The NVD record does not name one. Check the TOTOLINK download page for your exact model and read the release notes before you rely on a newer version.
What is the quickest mitigation?
Make sure the management interface is not reachable from the internet and limit it to one trusted host on the local network.
Sources
Last reviewed: 18 October 2026.
