CVE-2025-7154

MEDIUM

TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216 - OS Command Injection via Hostname Parameter

Title source: llm
STIX 2.1

Description

A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216. Affected by this issue is the function sub_41A0F8 of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Hostname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.315092
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.315092
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.606230
Product product
https://www.totolink.net/

Scores

CVSS v3 6.3
EPSS 0.0571
EPSS Percentile 90.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (2)
totolink/n200re_firmware 9.3.5u.6095_b20200916
totolink/n200re_firmware 9.3.5u.6139_b20201216
Published Jul 08, 2025
Tracked Since Feb 18, 2026