CVE-2025-45800

TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, specifically in the processing of the deviceMac parameter.

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.95% chance of exploitation in the next 30 days, 61st percentile

Published

2025-05-02

Updated

2025-05-12

Proof-of-concept exploits (1)

• SunnyYANGyaya/cuicuishark-sheep-fishIOT/blob/main/ToTolink/A950RG/5024-setDeviceName-devi…14★ · 2026-09-20

References

• CVE Record
• NVD entry

Related

• CVE-2025-25635
• CVE-2026-1686
• CVE-2026-1687
• CVE-2026-1689
• CVE-2026-1690
• CVE-2026-2202