CVE-2025-7524

MEDIUM

TOTOLINK T6 4.1.5cu.748_B20211015 - Command Injection

Title source: llm
STIX 2.1

Description

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.316221
Permissions Required signature permissions-required
https://vuldb.com/?ctiid.316221
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.612935
Exploit, Third Party Advisory exploit
https://github.com/ElvisBlue/Public/blob/main/Vuln/2.md#poc
Product product
https://www.totolink.net/

Scores

CVSS v3 6.3
EPSS 0.0156
EPSS Percentile 81.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (1)
totolink/t6_firmware v4.1.5cu.748_b20211015
Published Jul 13, 2025
Tracked Since Feb 18, 2026