We need to produce a comprehensive analysis of CVE-2025-7862 based on all provided data, with strict adherence to formatting and content rules. First, let's parse the data: CVE-2025-7862 Description: A vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015, classified as critical. The function setTelnetCfg in /cgi-bin/cstecgi.cgi of Telnet Service, argument telnet_enabled with input 1 leads to missing authentication. Attack can be launched remotely. Exploit disclosed publicly. CVSS: 5.5 (this is a CVSS 4.0 score, not CVSS 3.1) with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/... etc. Base score 5.5 seems low despite AV:N/PR:N because impact is Low on all three. So it's a low-impact vulnerability (maybe enable telnet with low impact on confidentiality/integrity/availability? Actually, it's missing authentication so enabling telnet might allow unauthenticated access. CVSS 4.0 has VC:L/VI:L/VA:L, meaning low impact on confidentiality, integrity, availability of the vulnerable component. SC:N/SI:N/SA:N means no impact to subsequent systems. So it's low severity. CWE-287: Improper Authentication Multi-source: - EPSS: 0.18% (low, 39th percentile) — low probability of exploitation being active. - POC/Exploit: Publicly available. - Reported by cna@vuldb.com - CPE: cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015... (firmware, version exactly that) - Tags: Authentication Bypass, T6 Firmware - References: multiple github links with exploit details, youtube video. No official vendor advisory. No KEV mention (so not in KEV). No patch info in the input explicitly. Let's interpret the vulnerability: The setTelnetCfg function in a CGI script takes a parameter telnet_enabled. If sent with value 1 (likely a request without authentication), the Telnet service gets enabled without proper authentication check. So an unauthenticated remote attacker can enable telnet on the device, which might then allow them to access it via telnet without credentials (missing authentication for telnet itself or the configuration action?). The description says "missing authentication" for the action of setting telnet_enabled. So anyone can remotely send a request to enable telnet, which would then expose the device to unauthenticated telnet logins? The impact is that an attacker could enable telnet and then gain access to the device (low integrity, low confidentiality, low availability). CVSS 4.0 indicates low impacts (all L), so maybe it's just enabling a service that is itself unauthenticated, but the overall compromise is not full root? However, low impact for confidentiality, integrity, availability suggests the vulnerability alone doesn't give full access; maybe telnet itself still requires login, but missing authentication on configuration change allows enabling a service that is normally disabled. But then the attacker would have to have telnet credentials? The missing authentication allows an attacker to turn on telnet, which then maybe has default credentials, so the chain could lead to unauthorized access. Still, the base score is low (5.5) in CVSS 4.0 (which is roughly medium). But the vulnerability is classified as critical by reporter. The discrepancy: reporter calls it critical, but CVSS 4.0 base 5.5 is medium-low. The CVSS vector is from vuldb? The submitted vector has PR:N, AV:N, so it's remotely exploitable, but impacts are low. So it's not a critical vulnerability per CVSS, but the ability to enable telnet remotely without auth could be a stepping stone. We need to produce a JSON with all fields. Let's go field by field. product_name: "TOTOLINK T6" (should be 1-3 words). TOTOLINK T6 firmware is the product. So product_name: "TOTOLINK T6". summary: Must not copy description. Write "Missing authentication in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows remote unauthenticated attackers to enable the Telnet service by sending a crafted request to the /cgi-bin/cstecgi.cgi endpoint. While the vulnerability has a low CVSS score (5.5) and low EPSS exploitation probability (0.18%), publicly available proof-of-concept exploit code exists, and the lack of authentication on the configuration function could serve as an entry point for further compromise." We need to mention: active exploitation? KEV=NO, so not actively exploited, but POC exists. So "publicly available exploit code exists". Not "confirmed actively exploited". Use phrase "publicly available exploit code exists". Also note EPSS low. technical_context: Explain underlying tech: TOTOLINK T6 is a wireless router, the firmware version affected runs a CGI script /cgi-bin/cstecgi.cgi handling configuration settings. The specific function setTelnetCfg presumably handles telnet configuration, and the vulnerability is CWE-287 Improper Authentication, meaning the function does not verify the caller's credentials before changing the telnet_enabled parameter. The CPE confirms the exact firmware version. risk_assessment: Assess real-world risk. CVSS 4.0 vector: AV:N (network), PR:N (no privileges), UI:N, impact low. So severity low. EPSS 0.18% (low chance of exploitation). KEV: NO. POC: publicly available. SSVC: exploitation status: POC public but no active exploitation; automatable? The attack is simple: send a single HTTP request. Technical impact: low (enable telnet). So risk is low overall. However, the missing authentication on configuration change might be used to enable telnet, which then perhaps exposes default credentials, so the full impact could be higher if chained. But directly, CVSS says low. So it's likely a low-severity issue. Contrast with "critical" classification from reporter. So we'll mention discrepancy: reporter classified as critical, but CVSS base score 5.5 (Medium/Low) and low EPSS suggest lower real-world risk. So not a high priority. But still, for TOTOLINK T6 devices, it could be used as a foothold. If there are no compensating controls (like telnet not useful without credentials), the risk might be limited. The CVSS vector indicates low confidentiality, integrity, availability impacts, so maybe the exploit just enables telnet, but the actual telnet service still requires authentication (e.g., default credentials), so the missing authentication on the enable action doesn't directly grant access; rather it enables a service that could then be brute-forced. That's why impacts are low. So the risk is limited. We should note that the available exploit does not grant root, but opens a service. So real risk is low despite public exploit. affected_products: "TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. According to CPE string cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015, only this version is explicitly affected. References include the vendor website (totolink.net) but no vendor advisory confirming affected versions. The GitHub PoC specifically targets this firmware version." remediation: "As of this analysis, no vendor patch has been identified. Administrators should check TOTOLINK's official website for an updated firmware version that addresses CVE-2025-7862. In the interim, consider implementing network-layer access controls to restrict access to the /cgi-bin/cstecgi.cgi endpoint from untrusted IP addresses. Disable remote administration via WAN if feasible. Note that blocking access to the CGI endpoint may also disable other web management functions. Monitoring for unexpected enablement of Telnet via syslog or configuration changes can help detect exploitation." The input references did not include a patch advisory, so we state no patch identified. exploit_scenario: "An attacker on the same network or internet-facing device sends an unauthenticated HTTP request to /cgi-bin/cstecgi.cgi with the parameter telnet_enabled=1. The request bypasses authentication checks, causing the Telnet service to start. With Telnet now enabled and potentially using default credentials, the attacker can then attempt to log in and gain further control. The publicly available PoC demonstrates this simple exploitation." exploitation_conditions: Extract prerequisites: "The vulnerability affects TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 with the web management interface accessible (default configuration). No authentication is required; the attacker only needs to reach the endpoint. The exploitation condition is that the telnet service must be initially disabled (default state) for the enable action to be meaningful. If telnet is already enabled or the endpoint is not reachable from the attacker's network position, the vulnerability cannot be exploited. The attack is remote and requires no user interaction." So the condition is specific: "The TOTOLINK T6 router must run the vulnerable firmware version, have its web management interface exposed (default), and Telnet initially disabled. No authentication is required." That's concrete. attack_chain: "Send unauthenticated HTTP request to enable telnet → The CGI script processes the request without authentication → Telnet service is started and becomes accessible → Attacker connects via Telnet using default credentials or brute-force → Achieve limited impact on confidentiality, integrity, and availability." But the description only mentions enabling telnet, not credentials. So we could have a shorter chain: "Send crafted request to enable Telnet → Bypass authentication → Telnet service starts, enabling subsequent unauthorized access attempts." I'll use: "Access exposed router web interface → Send HTTP request to /cgi-bin/cstecgi.cgi with telnet_enabled=1 → Missing authentication check allows configuration change → Telnet service is enabled → Attacker can now attempt Telnet login with default or brute-forced credentials → Gain low-level access to router." That reflects kill chain phases: Access, Delivery, Exploit, Execution, Impact. 6 steps maybe. I'll do: "Access reachable router web management → Deliver crafted HTTP POST/GET with telnet_enabled=1 → Exploit missing authentication to process request → Execute enabling of Telnet daemon → Establish Telnet connection to router → Impact: low confidentiality/integrity/availability via Telnet access." confident_notes: "Exploit confirmed publicly via GitHub and YouTube video. No vendor advisory or patch exists, and CVE entry assigned by VulDB (cna@vuldb.com). No confirmation of active exploitation in the wild (CISA KEV not listed). The CVSS 4.0 vector is provided by the reporter; low impact scores align with the limited nature of the bug. EPSS probability suggests minimal exploitation activity." We'll say: "Exploit code publicly available and confirmed by external PoC references. The CVE was issued by VulDB, not the vendor, and no patch has been released. No independent confirmation of active exploitation; EPSS score of 0.18% indicates low exploitation probability." prevalence: TOTOLINK routers are not as widespread as major brands, but T6 is a specific model. Likely medium? I'd say "low" because it's a specific consumer router model from a lesser-known brand, not widely deployed in enterprise. The product is a home router, so maybe medium if it's popular in some markets. But we can't be sure. I'll use "low" with justification. prevalence: "low" prevalence_basis: "specific consumer router model with limited market share" assessed_cvss_vector: Need to create our own CVSS 3.1 base metric for this. Since the CVSS 4.0 vector suggests AV:N/AC:L/PR:N/UI:N, but impact is limited to low, we will produce a CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That gives a base score of 4.3 (close to CVSS 4.0 5.5). But CVSS 3.1 with C:L/I:L/A:L yields 5.0? Let's calculate: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L => base score 5.0? Actually, CVSS 3.1 calculator: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> 5.0 (Medium). But our CVSS 4.0 base was 5.5, so I'll just produce the 3.1 vector with proper reasoning. However, we
Authentication bypass in MetaCRM up to 6.4.2 allows unauthenticated remote attackers to gain unauthorized access via the /debug.jsp endpoint. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed (no CISA KEV listing). The vulnerability carries a medium base score (CVSS 5.5) and a low exploitation probability (EPSS 0.12%).
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify database content through the Username parameter in search.php. A public exploit is available, but no evidence of active exploitation exists and the EPSS probability is extremely low.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /members/login_admin.php. Public exploit code is available, but no active exploitation has been confirmed. The CVSS 4.0 score is 5.5 (medium), and EPSS exploitation probability is very low (0.07%), indicating limited real-world risk despite the publicly available exploit.
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_password parameter in /members/update_password_admin.php, enabling arbitrary SQL execution that can modify admin passwords or extract data. A public exploit is available, though EPSS (0.07%) suggests low exploitation probability in the wild.
SQL injection in pmTicket project management software allows remote attackers to manipulate database queries via the user_id parameter in the getUserLanguage function. All known versions are affected due to the project's rolling release model; the vendor has not responded to the disclosure.