T6 Firmware CVE-2025-7460

This vulnerability presents HIGH real-world risk despite requiring authentication (PR:L). Risk signals: (1) CVSS 8.8 reflects severe impact—Confidentiality, Integrity, and Availability all HIGH, indicating code execution capability; (2) CVSS vector AV:N/AC:L indicates network-accessible attack with low complexity; (3) Public POC availability significantly increases exploitation probability; (4) The AC:L (Low Complexity) and PR:L (Low Privilege) requirements are concerning in home/SMB router contexts where default credentials persist or users connect untrusted devices to WiFi networks; (5) Many TOTOLINK devices operate in environments with poor security posture where default admin credentials remain unchanged. While EPSS data is not provided here, the combination of public exploit code, low technical barrier, and widespread deployment of legacy TOTOLINK firmware suggests EPSS would exceed 0.80. This is not a theoretical high-CVSS issue—the disclosed POC and straightforward exploitation path make it actionable threat. Organizations managing TOTOLINK deployments should treat this as critical.

An attacker on the same local network (or who has compromised a connected device) authenticates to the TOTOLINK T6 admin interface using default credentials (admin/admin, common in this device class) or previously obtained credentials. The attacker crafts an HTTP POST request to http://[router-ip]/cgi-bin/cstecgi.cgi with the 'setWiFiAclRules' function call and supplies a MAC address parameter exceeding the buffer size (e.g., 300+ bytes instead of the expected 17-byte MAC format). The overflow overwrites adjacent stack memory, potentially overwriting return addresses or function pointers. If the attacker has pre-positioned shellcode or leverages ROP gadgets in the firmware binary, code execution is achieved with the privileges of the web server process (typically root/admin on embedded routers). From this foothold, the attacker can reconfigure WiFi settings, exfiltrate traffic, modify firmware, or pivot to internal networks. The public POC likely provides exact offset calculations and payload templates, reducing the barrier to exploitation to script-kiddie level.