CVE-2025-7525

MEDIUM

TOTOLINK T6 4.1.5cu.748_B20211015 - Command Injection

Title source: llm
STIX 2.1

Description

A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument command leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.316222
Permissions Required signature permissions-required
https://vuldb.com/?ctiid.316222
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.612936
Exploit media-coverage
https://youtu.be/GawLaYfTwYs
Product product
https://www.totolink.net/

Scores

CVSS v3 6.3
EPSS 0.0156
EPSS Percentile 81.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (1)
totolink/t6_firmware v4.1.5cu.748_b20211015
Published Jul 13, 2025
Tracked Since Feb 18, 2026