T6 Firmware CVE-2025-7862

MEDIUM

Improper Authentication (CWE-287)

2025-07-20 cna@vuldb.com

Authentication Bypass T6 Firmware

5.5

CVSS 4.0 · NVD

Share

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

X

DescriptionCVE.org

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Analysis

A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

More in T6 Firmware

View all

CVE-2023-7221 CRITICAL Act Now POC

A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2022-38828 CRITICAL Act Now POC

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi. Rated critical severity (CVSS 9.8

CVE-2022-38827 CRITICAL Act Now POC

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi. Rated critical severity (CVSS 9.8),

CVE-2022-38826 CRITICAL Act Now POC

In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. Rated critical severity (CV

CVE-2022-38823 CRITICAL Act Now POC

In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. Rated critical sev

CVE-2022-25084 CRITICAL Act Now POC

TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. Rat

CVE-2025-7460 HIGH This Week POC

CVE-2025-7460 is a critical buffer overflow vulnerability in the setWiFiAclRules function of TOTOLINK T6 routers (versio

CVE-2022-32053 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the functio

CVE-2022-32052 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FU

CVE-2022-32051 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime paramete

CVE-2022-32050 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the functio

CVE-2022-32049 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN

Same weakness CWE-287 – Improper Authentication

View all

CVE-2020-0688 HIGH POC

CVE-2023-46805 HIGH POC

CVE-2015-1187 CRITICAL POC

CVE-2024-7593 CRITICAL POC

CVE-2017-7921 CRITICAL POC

CVE-2024-53704 CRITICAL POC

CVE-2015-7755 CRITICAL POC

CVE-2013-0625 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2012-1723 CRITICAL POC

CVE-2017-10271 HIGH POC

CVE-2015-1427 CRITICAL POC

CVE-2025-3248 CRITICAL POC

Share

CVE-2025-7862 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy