T6 Firmware EUVD-2025-21358

| CVE-2025-7614 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-14 cna@vuldb.com

Command Injection T6 Firmware TOTOLINK

2.1

CVSS 4.0 · NVD

View

Vulnerability Assessment

Weakness

CWE

OWASP Top 10:2025

A05:2025 - Injection

ASVS 5.0

V1 - Encoding and Sanitization Input neutralization, injection prevention

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 1.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Jul 27, 2026

Command injection in TOTOLINK T6 firmware version 4.1.5cu.748 allows authenticated remote attackers to execute arbitrary OS commands via the ipAddr parameter in a crafted request to /cgi-bin/cstecgi.cgi. The vulnerability resides in the delDevice function of the HTTP POST handler, and publicly available exploit code exists. Although the vendor-reported CVSS 4.0 score is low (2.1), weaponizing this flaw can lead to full router compromise, making it critical for affected devices.

Affected VersionsENISA

T6 4.1.5cu.748

Affected Packages

euvd t6 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when T6 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

5

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Jul 16, 2025 - 14:31 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 15:15 nvd

MEDIUM 6.3

CVE Published

Jul 14, 2025 - 15:15 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Threat Intelligence Overview

EPSS Score

1.6%

Top 18% exploitable

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 1.6%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

No

Human Impact· derived

Low

Priority Score

32

Low Medium High Critical

KEV: 0

EPSS: +2

CVSS: +10

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

More in T6 Firmware

View all

CVE-2023-7221 CRITICAL Act Now POC

A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2022-38828 CRITICAL Act Now POC

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi. Rated critical severity (CVSS 9.8

CVE-2022-38827 CRITICAL Act Now POC

TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi. Rated critical severity (CVSS 9.8),

CVE-2022-38826 CRITICAL Act Now POC

In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. Rated critical severity (CV

CVE-2022-38823 CRITICAL Act Now POC

In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. Rated critical sev

CVE-2022-25084 CRITICAL Act Now POC

TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. Rat

CVE-2025-7460 HIGH This Week POC

CVE-2025-7460 is a critical buffer overflow vulnerability in the setWiFiAclRules function of TOTOLINK T6 routers (versio

CVE-2022-32053 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the functio

CVE-2022-32052 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FU

CVE-2022-32051 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime paramete

CVE-2022-32050 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the functio

CVE-2022-32049 HIGH This Week POC

TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all

CVE-2019-2725 CRITICAL POC

CVE-2013-2251 CRITICAL POC

CVE-2022-27924 HIGH POC

CVE-2016-4010 CRITICAL POC

CVE-2015-1592 HIGH POC

CVE-2025-20281 CRITICAL POC

CVE-2023-29525 HIGH POC

CVE-2015-7309 MEDIUM POC

Same technique Command Injection

View all

CVE-2024-21887 CRITICAL POC

CVE-2019-15107 CRITICAL POC

CVE-2016-3081 HIGH POC

CVE-2024-51378 CRITICAL POC

CVE-2012-1823 CRITICAL POC

CVE-2016-1555 CRITICAL POC

CVE-2014-6271 CRITICAL POC

CVE-2024-55956 CRITICAL POC

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-7614 REF https://vuldb.com/?ctiid.316314 REF https://vuldb.com/?id.316314 REF https://vuldb.com/?submit.615368 REF https://www.totolink.net/

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy