MEDIUM
TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injection
Published Jul 14, 2025
5.3
MEDIUMCVSS 4.0
EPSS 2.42%
Description
A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Affected products
-
Affected
- 4.1.5cu.748
AND
- v4.1.5cu.748_b20211015
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (7)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21358 Advisory
- https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md exploitrelatedThird Party Advisory
- https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md#poc exploit
- https://vuldb.com/?ctiid.316314 signaturepermissions-requiredPermissions RequiredVDB Entry
- https://vuldb.com/?id.316314 vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
- https://vuldb.com/?submit.615368 third-party-advisoryThird Party AdvisoryVDB Entry
- https://www.totolink.net/ product
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21358 | Advisory | |
| https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md | exploitrelatedThird Party Advisory | |
| https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md#poc | exploit | |
| https://vuldb.com/?ctiid.316314 | signaturepermissions-requiredPermissions RequiredVDB Entry | |
| https://vuldb.com/?id.316314 | vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry | |
| https://vuldb.com/?submit.615368 | third-party-advisoryThird Party AdvisoryVDB Entry | |
| https://www.totolink.net/ | product |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Jul 14, 2025
Updated Jul 15, 2025
Reserved Jul 13, 2025
Link CVE-2025-7614
CISA Vulnrichment
Updated Jul 14, 2025
Red Hat
No data
GitHub
No data