#IoT

Description I bought a TOTOLINK A720R specifically for this. TOTOLINK was a vendor I had never done any research on, so I picked up one of their models to take a look. It looked like an easy target: a small SOHO router with a web-based admin panel and the usual embedded stack. What started as a quick look at the web interface turned into three separate findings, all reachable through the same binary, cstecgi.cgi, which handles almost the entire web UI. ...

Description During the research process on the TP-Link Archer RE605X range extender, multiple security issues were identified. An initial weakness in the control panel authentication mechanism allows an adjacent unauthenticated attacker to intercept session cookies and CSRF tokens of an active user and reuse them to gain administrative access to the device. This issue is described as an additional finding observed during the research and is not included in the official CVE advisory. In addition, two vulnerabilities affecting the firmware backup and restore functionality were discovered. The use of hardcoded cryptographic keys allows authenticated attackers to decrypt, modify, and re-encrypt configuration files, leading to sensitive information disclosure and configuration tampering. Furthermore, insufficient validation of XML tags during configuration parsing allows authenticated attackers to achieve remote code execution as root on the device. These issues are covered by CVE-2025-15545. ...