T6 Firmware
Monthly
Command injection in TOTOLINK T6 firmware 4.1.5cu.748 allows authenticated remote attackers to execute arbitrary commands via the ckeckKeepAlive function in the MQTT Packet Handler component (wireless.so). The vulnerability requires valid user credentials and network access but results only in low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the CVSS 2.1 score and EPSS 3.01% indicate low practical exploitation probability despite public disclosure.
We need to produce a comprehensive analysis of CVE-2025-7862 based on all provided data, with strict adherence to formatting and content rules. First, let's parse the data: CVE-2025-7862 Description: A vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015, classified as critical. The function setTelnetCfg in /cgi-bin/cstecgi.cgi of Telnet Service, argument telnet_enabled with input 1 leads to missing authentication. Attack can be launched remotely. Exploit disclosed publicly. CVSS: 5.5 (this is a CVSS 4.0 score, not CVSS 3.1) with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/... etc. Base score 5.5 seems low despite AV:N/PR:N because impact is Low on all three. So it's a low-impact vulnerability (maybe enable telnet with low impact on confidentiality/integrity/availability? Actually, it's missing authentication so enabling telnet might allow unauthenticated access. CVSS 4.0 has VC:L/VI:L/VA:L, meaning low impact on confidentiality, integrity, availability of the vulnerable component. SC:N/SI:N/SA:N means no impact to subsequent systems. So it's low severity. CWE-287: Improper Authentication Multi-source: - EPSS: 0.18% (low, 39th percentile) — low probability of exploitation being active. - POC/Exploit: Publicly available. - Reported by cna@vuldb.com - CPE: cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015... (firmware, version exactly that) - Tags: Authentication Bypass, T6 Firmware - References: multiple github links with exploit details, youtube video. No official vendor advisory. No KEV mention (so not in KEV). No patch info in the input explicitly. Let's interpret the vulnerability: The setTelnetCfg function in a CGI script takes a parameter telnet_enabled. If sent with value 1 (likely a request without authentication), the Telnet service gets enabled without proper authentication check. So an unauthenticated remote attacker can enable telnet on the device, which might then allow them to access it via telnet without credentials (missing authentication for telnet itself or the configuration action?). The description says "missing authentication" for the action of setting telnet_enabled. So anyone can remotely send a request to enable telnet, which would then expose the device to unauthenticated telnet logins? The impact is that an attacker could enable telnet and then gain access to the device (low integrity, low confidentiality, low availability). CVSS 4.0 indicates low impacts (all L), so maybe it's just enabling a service that is itself unauthenticated, but the overall compromise is not full root? However, low impact for confidentiality, integrity, availability suggests the vulnerability alone doesn't give full access; maybe telnet itself still requires login, but missing authentication on configuration change allows enabling a service that is normally disabled. But then the attacker would have to have telnet credentials? The missing authentication allows an attacker to turn on telnet, which then maybe has default credentials, so the chain could lead to unauthorized access. Still, the base score is low (5.5) in CVSS 4.0 (which is roughly medium). But the vulnerability is classified as critical by reporter. The discrepancy: reporter calls it critical, but CVSS 4.0 base 5.5 is medium-low. The CVSS vector is from vuldb? The submitted vector has PR:N, AV:N, so it's remotely exploitable, but impacts are low. So it's not a critical vulnerability per CVSS, but the ability to enable telnet remotely without auth could be a stepping stone. We need to produce a JSON with all fields. Let's go field by field. product_name: "TOTOLINK T6" (should be 1-3 words). TOTOLINK T6 firmware is the product. So product_name: "TOTOLINK T6". summary: Must not copy description. Write "Missing authentication in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows remote unauthenticated attackers to enable the Telnet service by sending a crafted request to the /cgi-bin/cstecgi.cgi endpoint. While the vulnerability has a low CVSS score (5.5) and low EPSS exploitation probability (0.18%), publicly available proof-of-concept exploit code exists, and the lack of authentication on the configuration function could serve as an entry point for further compromise." We need to mention: active exploitation? KEV=NO, so not actively exploited, but POC exists. So "publicly available exploit code exists". Not "confirmed actively exploited". Use phrase "publicly available exploit code exists". Also note EPSS low. technical_context: Explain underlying tech: TOTOLINK T6 is a wireless router, the firmware version affected runs a CGI script /cgi-bin/cstecgi.cgi handling configuration settings. The specific function setTelnetCfg presumably handles telnet configuration, and the vulnerability is CWE-287 Improper Authentication, meaning the function does not verify the caller's credentials before changing the telnet_enabled parameter. The CPE confirms the exact firmware version. risk_assessment: Assess real-world risk. CVSS 4.0 vector: AV:N (network), PR:N (no privileges), UI:N, impact low. So severity low. EPSS 0.18% (low chance of exploitation). KEV: NO. POC: publicly available. SSVC: exploitation status: POC public but no active exploitation; automatable? The attack is simple: send a single HTTP request. Technical impact: low (enable telnet). So risk is low overall. However, the missing authentication on configuration change might be used to enable telnet, which then perhaps exposes default credentials, so the full impact could be higher if chained. But directly, CVSS says low. So it's likely a low-severity issue. Contrast with "critical" classification from reporter. So we'll mention discrepancy: reporter classified as critical, but CVSS base score 5.5 (Medium/Low) and low EPSS suggest lower real-world risk. So not a high priority. But still, for TOTOLINK T6 devices, it could be used as a foothold. If there are no compensating controls (like telnet not useful without credentials), the risk might be limited. The CVSS vector indicates low confidentiality, integrity, availability impacts, so maybe the exploit just enables telnet, but the actual telnet service still requires authentication (e.g., default credentials), so the missing authentication on the enable action doesn't directly grant access; rather it enables a service that could then be brute-forced. That's why impacts are low. So the risk is limited. We should note that the available exploit does not grant root, but opens a service. So real risk is low despite public exploit. affected_products: "TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. According to CPE string cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015, only this version is explicitly affected. References include the vendor website (totolink.net) but no vendor advisory confirming affected versions. The GitHub PoC specifically targets this firmware version." remediation: "As of this analysis, no vendor patch has been identified. Administrators should check TOTOLINK's official website for an updated firmware version that addresses CVE-2025-7862. In the interim, consider implementing network-layer access controls to restrict access to the /cgi-bin/cstecgi.cgi endpoint from untrusted IP addresses. Disable remote administration via WAN if feasible. Note that blocking access to the CGI endpoint may also disable other web management functions. Monitoring for unexpected enablement of Telnet via syslog or configuration changes can help detect exploitation." The input references did not include a patch advisory, so we state no patch identified. exploit_scenario: "An attacker on the same network or internet-facing device sends an unauthenticated HTTP request to /cgi-bin/cstecgi.cgi with the parameter telnet_enabled=1. The request bypasses authentication checks, causing the Telnet service to start. With Telnet now enabled and potentially using default credentials, the attacker can then attempt to log in and gain further control. The publicly available PoC demonstrates this simple exploitation." exploitation_conditions: Extract prerequisites: "The vulnerability affects TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 with the web management interface accessible (default configuration). No authentication is required; the attacker only needs to reach the endpoint. The exploitation condition is that the telnet service must be initially disabled (default state) for the enable action to be meaningful. If telnet is already enabled or the endpoint is not reachable from the attacker's network position, the vulnerability cannot be exploited. The attack is remote and requires no user interaction." So the condition is specific: "The TOTOLINK T6 router must run the vulnerable firmware version, have its web management interface exposed (default), and Telnet initially disabled. No authentication is required." That's concrete. attack_chain: "Send unauthenticated HTTP request to enable telnet → The CGI script processes the request without authentication → Telnet service is started and becomes accessible → Attacker connects via Telnet using default credentials or brute-force → Achieve limited impact on confidentiality, integrity, and availability." But the description only mentions enabling telnet, not credentials. So we could have a shorter chain: "Send crafted request to enable Telnet → Bypass authentication → Telnet service starts, enabling subsequent unauthorized access attempts." I'll use: "Access exposed router web interface → Send HTTP request to /cgi-bin/cstecgi.cgi with telnet_enabled=1 → Missing authentication check allows configuration change → Telnet service is enabled → Attacker can now attempt Telnet login with default or brute-forced credentials → Gain low-level access to router." That reflects kill chain phases: Access, Delivery, Exploit, Execution, Impact. 6 steps maybe. I'll do: "Access reachable router web management → Deliver crafted HTTP POST/GET with telnet_enabled=1 → Exploit missing authentication to process request → Execute enabling of Telnet daemon → Establish Telnet connection to router → Impact: low confidentiality/integrity/availability via Telnet access." confident_notes: "Exploit confirmed publicly via GitHub and YouTube video. No vendor advisory or patch exists, and CVE entry assigned by VulDB (cna@vuldb.com). No confirmation of active exploitation in the wild (CISA KEV not listed). The CVSS 4.0 vector is provided by the reporter; low impact scores align with the limited nature of the bug. EPSS probability suggests minimal exploitation activity." We'll say: "Exploit code publicly available and confirmed by external PoC references. The CVE was issued by VulDB, not the vendor, and no patch has been released. No independent confirmation of active exploitation; EPSS score of 0.18% indicates low exploitation probability." prevalence: TOTOLINK routers are not as widespread as major brands, but T6 is a specific model. Likely medium? I'd say "low" because it's a specific consumer router model from a lesser-known brand, not widely deployed in enterprise. The product is a home router, so maybe medium if it's popular in some markets. But we can't be sure. I'll use "low" with justification. prevalence: "low" prevalence_basis: "specific consumer router model with limited market share" assessed_cvss_vector: Need to create our own CVSS 3.1 base metric for this. Since the CVSS 4.0 vector suggests AV:N/AC:L/PR:N/UI:N, but impact is limited to low, we will produce a CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That gives a base score of 4.3 (close to CVSS 4.0 5.5). But CVSS 3.1 with C:L/I:L/A:L yields 5.0? Let's calculate: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L => base score 5.0? Actually, CVSS 3.1 calculator: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> 5.0 (Medium). But our CVSS 4.0 base was 5.5, so I'll just produce the 3.1 vector with proper reasoning. However, we
Command injection in TOTOLINK T6 router firmware 4.1.5cu.748 allows remote attackers to execute arbitrary OS commands by manipulating the 'ip' parameter of the clearPairCfg function in the /cgi-bin/cstecgi.cgi HTTP POST handler. Exploit code is publicly available, but no active exploitation has been confirmed.
Command injection in TOTOLINK T6 firmware version 4.1.5cu.748 allows authenticated remote attackers to execute arbitrary OS commands via the ipAddr parameter in a crafted request to /cgi-bin/cstecgi.cgi. The vulnerability resides in the delDevice function of the HTTP POST handler, and publicly available exploit code exists. Although the vendor-reported CVSS 4.0 score is low (2.1), weaponizing this flaw can lead to full router compromise, making it critical for affected devices.
Command injection in TOTOLINK T6 firmware 4.1.5cu.748 allows remote authenticated attackers with low privileges to execute arbitrary system commands via the ip parameter of the CloudSrvVersionCheck function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is available, and while EPSS indicates a moderate 1.64% exploitation probability (82nd percentile), no active exploitation has been confirmed by CISA KEV at this time.
Command injection in TOTOLINK T6 router firmware allows authenticated low-privilege remote attackers to execute arbitrary OS commands via a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. Public exploit code is available, increasing the risk of automated or opportunistic attacks, but no active exploitation is confirmed via CISA KEV. While the CNA-assigned CVSS 4.0 score is low (2.1), real-world impact may be total device compromise if the web server runs with elevated privileges, as is common in embedded routers.
Remote command injection in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows authenticated attackers with low privileges to execute arbitrary commands via the ip parameter in HTTP POST requests to /cgi-bin/cstecgi.cgi. Exploit code is publicly available, and EPSS indicates moderate exploitation likelihood, though no active KEV listing exists.
CVE-2025-7460 is a critical buffer overflow vulnerability in the setWiFiAclRules function of TOTOLINK T6 routers (version 4.1.5cu.748_B20211015) that allows authenticated remote attackers to achieve code execution through malformed MAC address parameters in HTTP POST requests. The vulnerability has been publicly disclosed with proof-of-concept availability and poses immediate risk to deployed TOTOLINK T6 devices; exploitation requires valid credentials but no user interaction.
Authentication bypass in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows adjacent network attackers to manipulate the authCode or goURL parameters to bypass authentication on the /formLoginAuth.htm endpoint. The vulnerability enables unauthorized access to administrative functions without credentials. Publicly available exploit code exists, but no active exploitation has been confirmed.
A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Command injection in TOTOLINK T6 firmware 4.1.5cu.748 allows authenticated remote attackers to execute arbitrary commands via the ckeckKeepAlive function in the MQTT Packet Handler component (wireless.so). The vulnerability requires valid user credentials and network access but results only in low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the CVSS 2.1 score and EPSS 3.01% indicate low practical exploitation probability despite public disclosure.
We need to produce a comprehensive analysis of CVE-2025-7862 based on all provided data, with strict adherence to formatting and content rules. First, let's parse the data: CVE-2025-7862 Description: A vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015, classified as critical. The function setTelnetCfg in /cgi-bin/cstecgi.cgi of Telnet Service, argument telnet_enabled with input 1 leads to missing authentication. Attack can be launched remotely. Exploit disclosed publicly. CVSS: 5.5 (this is a CVSS 4.0 score, not CVSS 3.1) with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/... etc. Base score 5.5 seems low despite AV:N/PR:N because impact is Low on all three. So it's a low-impact vulnerability (maybe enable telnet with low impact on confidentiality/integrity/availability? Actually, it's missing authentication so enabling telnet might allow unauthenticated access. CVSS 4.0 has VC:L/VI:L/VA:L, meaning low impact on confidentiality, integrity, availability of the vulnerable component. SC:N/SI:N/SA:N means no impact to subsequent systems. So it's low severity. CWE-287: Improper Authentication Multi-source: - EPSS: 0.18% (low, 39th percentile) — low probability of exploitation being active. - POC/Exploit: Publicly available. - Reported by cna@vuldb.com - CPE: cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015... (firmware, version exactly that) - Tags: Authentication Bypass, T6 Firmware - References: multiple github links with exploit details, youtube video. No official vendor advisory. No KEV mention (so not in KEV). No patch info in the input explicitly. Let's interpret the vulnerability: The setTelnetCfg function in a CGI script takes a parameter telnet_enabled. If sent with value 1 (likely a request without authentication), the Telnet service gets enabled without proper authentication check. So an unauthenticated remote attacker can enable telnet on the device, which might then allow them to access it via telnet without credentials (missing authentication for telnet itself or the configuration action?). The description says "missing authentication" for the action of setting telnet_enabled. So anyone can remotely send a request to enable telnet, which would then expose the device to unauthenticated telnet logins? The impact is that an attacker could enable telnet and then gain access to the device (low integrity, low confidentiality, low availability). CVSS 4.0 indicates low impacts (all L), so maybe it's just enabling a service that is itself unauthenticated, but the overall compromise is not full root? However, low impact for confidentiality, integrity, availability suggests the vulnerability alone doesn't give full access; maybe telnet itself still requires login, but missing authentication on configuration change allows enabling a service that is normally disabled. But then the attacker would have to have telnet credentials? The missing authentication allows an attacker to turn on telnet, which then maybe has default credentials, so the chain could lead to unauthorized access. Still, the base score is low (5.5) in CVSS 4.0 (which is roughly medium). But the vulnerability is classified as critical by reporter. The discrepancy: reporter calls it critical, but CVSS 4.0 base 5.5 is medium-low. The CVSS vector is from vuldb? The submitted vector has PR:N, AV:N, so it's remotely exploitable, but impacts are low. So it's not a critical vulnerability per CVSS, but the ability to enable telnet remotely without auth could be a stepping stone. We need to produce a JSON with all fields. Let's go field by field. product_name: "TOTOLINK T6" (should be 1-3 words). TOTOLINK T6 firmware is the product. So product_name: "TOTOLINK T6". summary: Must not copy description. Write "Missing authentication in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows remote unauthenticated attackers to enable the Telnet service by sending a crafted request to the /cgi-bin/cstecgi.cgi endpoint. While the vulnerability has a low CVSS score (5.5) and low EPSS exploitation probability (0.18%), publicly available proof-of-concept exploit code exists, and the lack of authentication on the configuration function could serve as an entry point for further compromise." We need to mention: active exploitation? KEV=NO, so not actively exploited, but POC exists. So "publicly available exploit code exists". Not "confirmed actively exploited". Use phrase "publicly available exploit code exists". Also note EPSS low. technical_context: Explain underlying tech: TOTOLINK T6 is a wireless router, the firmware version affected runs a CGI script /cgi-bin/cstecgi.cgi handling configuration settings. The specific function setTelnetCfg presumably handles telnet configuration, and the vulnerability is CWE-287 Improper Authentication, meaning the function does not verify the caller's credentials before changing the telnet_enabled parameter. The CPE confirms the exact firmware version. risk_assessment: Assess real-world risk. CVSS 4.0 vector: AV:N (network), PR:N (no privileges), UI:N, impact low. So severity low. EPSS 0.18% (low chance of exploitation). KEV: NO. POC: publicly available. SSVC: exploitation status: POC public but no active exploitation; automatable? The attack is simple: send a single HTTP request. Technical impact: low (enable telnet). So risk is low overall. However, the missing authentication on configuration change might be used to enable telnet, which then perhaps exposes default credentials, so the full impact could be higher if chained. But directly, CVSS says low. So it's likely a low-severity issue. Contrast with "critical" classification from reporter. So we'll mention discrepancy: reporter classified as critical, but CVSS base score 5.5 (Medium/Low) and low EPSS suggest lower real-world risk. So not a high priority. But still, for TOTOLINK T6 devices, it could be used as a foothold. If there are no compensating controls (like telnet not useful without credentials), the risk might be limited. The CVSS vector indicates low confidentiality, integrity, availability impacts, so maybe the exploit just enables telnet, but the actual telnet service still requires authentication (e.g., default credentials), so the missing authentication on the enable action doesn't directly grant access; rather it enables a service that could then be brute-forced. That's why impacts are low. So the risk is limited. We should note that the available exploit does not grant root, but opens a service. So real risk is low despite public exploit. affected_products: "TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. According to CPE string cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015, only this version is explicitly affected. References include the vendor website (totolink.net) but no vendor advisory confirming affected versions. The GitHub PoC specifically targets this firmware version." remediation: "As of this analysis, no vendor patch has been identified. Administrators should check TOTOLINK's official website for an updated firmware version that addresses CVE-2025-7862. In the interim, consider implementing network-layer access controls to restrict access to the /cgi-bin/cstecgi.cgi endpoint from untrusted IP addresses. Disable remote administration via WAN if feasible. Note that blocking access to the CGI endpoint may also disable other web management functions. Monitoring for unexpected enablement of Telnet via syslog or configuration changes can help detect exploitation." The input references did not include a patch advisory, so we state no patch identified. exploit_scenario: "An attacker on the same network or internet-facing device sends an unauthenticated HTTP request to /cgi-bin/cstecgi.cgi with the parameter telnet_enabled=1. The request bypasses authentication checks, causing the Telnet service to start. With Telnet now enabled and potentially using default credentials, the attacker can then attempt to log in and gain further control. The publicly available PoC demonstrates this simple exploitation." exploitation_conditions: Extract prerequisites: "The vulnerability affects TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 with the web management interface accessible (default configuration). No authentication is required; the attacker only needs to reach the endpoint. The exploitation condition is that the telnet service must be initially disabled (default state) for the enable action to be meaningful. If telnet is already enabled or the endpoint is not reachable from the attacker's network position, the vulnerability cannot be exploited. The attack is remote and requires no user interaction." So the condition is specific: "The TOTOLINK T6 router must run the vulnerable firmware version, have its web management interface exposed (default), and Telnet initially disabled. No authentication is required." That's concrete. attack_chain: "Send unauthenticated HTTP request to enable telnet → The CGI script processes the request without authentication → Telnet service is started and becomes accessible → Attacker connects via Telnet using default credentials or brute-force → Achieve limited impact on confidentiality, integrity, and availability." But the description only mentions enabling telnet, not credentials. So we could have a shorter chain: "Send crafted request to enable Telnet → Bypass authentication → Telnet service starts, enabling subsequent unauthorized access attempts." I'll use: "Access exposed router web interface → Send HTTP request to /cgi-bin/cstecgi.cgi with telnet_enabled=1 → Missing authentication check allows configuration change → Telnet service is enabled → Attacker can now attempt Telnet login with default or brute-forced credentials → Gain low-level access to router." That reflects kill chain phases: Access, Delivery, Exploit, Execution, Impact. 6 steps maybe. I'll do: "Access reachable router web management → Deliver crafted HTTP POST/GET with telnet_enabled=1 → Exploit missing authentication to process request → Execute enabling of Telnet daemon → Establish Telnet connection to router → Impact: low confidentiality/integrity/availability via Telnet access." confident_notes: "Exploit confirmed publicly via GitHub and YouTube video. No vendor advisory or patch exists, and CVE entry assigned by VulDB (cna@vuldb.com). No confirmation of active exploitation in the wild (CISA KEV not listed). The CVSS 4.0 vector is provided by the reporter; low impact scores align with the limited nature of the bug. EPSS probability suggests minimal exploitation activity." We'll say: "Exploit code publicly available and confirmed by external PoC references. The CVE was issued by VulDB, not the vendor, and no patch has been released. No independent confirmation of active exploitation; EPSS score of 0.18% indicates low exploitation probability." prevalence: TOTOLINK routers are not as widespread as major brands, but T6 is a specific model. Likely medium? I'd say "low" because it's a specific consumer router model from a lesser-known brand, not widely deployed in enterprise. The product is a home router, so maybe medium if it's popular in some markets. But we can't be sure. I'll use "low" with justification. prevalence: "low" prevalence_basis: "specific consumer router model with limited market share" assessed_cvss_vector: Need to create our own CVSS 3.1 base metric for this. Since the CVSS 4.0 vector suggests AV:N/AC:L/PR:N/UI:N, but impact is limited to low, we will produce a CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That gives a base score of 4.3 (close to CVSS 4.0 5.5). But CVSS 3.1 with C:L/I:L/A:L yields 5.0? Let's calculate: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L => base score 5.0? Actually, CVSS 3.1 calculator: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> 5.0 (Medium). But our CVSS 4.0 base was 5.5, so I'll just produce the 3.1 vector with proper reasoning. However, we
Command injection in TOTOLINK T6 router firmware 4.1.5cu.748 allows remote attackers to execute arbitrary OS commands by manipulating the 'ip' parameter of the clearPairCfg function in the /cgi-bin/cstecgi.cgi HTTP POST handler. Exploit code is publicly available, but no active exploitation has been confirmed.
Command injection in TOTOLINK T6 firmware version 4.1.5cu.748 allows authenticated remote attackers to execute arbitrary OS commands via the ipAddr parameter in a crafted request to /cgi-bin/cstecgi.cgi. The vulnerability resides in the delDevice function of the HTTP POST handler, and publicly available exploit code exists. Although the vendor-reported CVSS 4.0 score is low (2.1), weaponizing this flaw can lead to full router compromise, making it critical for affected devices.
Command injection in TOTOLINK T6 firmware 4.1.5cu.748 allows remote authenticated attackers with low privileges to execute arbitrary system commands via the ip parameter of the CloudSrvVersionCheck function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is available, and while EPSS indicates a moderate 1.64% exploitation probability (82nd percentile), no active exploitation has been confirmed by CISA KEV at this time.
Command injection in TOTOLINK T6 router firmware allows authenticated low-privilege remote attackers to execute arbitrary OS commands via a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. Public exploit code is available, increasing the risk of automated or opportunistic attacks, but no active exploitation is confirmed via CISA KEV. While the CNA-assigned CVSS 4.0 score is low (2.1), real-world impact may be total device compromise if the web server runs with elevated privileges, as is common in embedded routers.
Remote command injection in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows authenticated attackers with low privileges to execute arbitrary commands via the ip parameter in HTTP POST requests to /cgi-bin/cstecgi.cgi. Exploit code is publicly available, and EPSS indicates moderate exploitation likelihood, though no active KEV listing exists.
CVE-2025-7460 is a critical buffer overflow vulnerability in the setWiFiAclRules function of TOTOLINK T6 routers (version 4.1.5cu.748_B20211015) that allows authenticated remote attackers to achieve code execution through malformed MAC address parameters in HTTP POST requests. The vulnerability has been publicly disclosed with proof-of-concept availability and poses immediate risk to deployed TOTOLINK T6 devices; exploitation requires valid credentials but no user interaction.
Authentication bypass in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows adjacent network attackers to manipulate the authCode or goURL parameters to bypass authentication on the /formLoginAuth.htm endpoint. The vulnerability enables unauthorized access to administrative functions without credentials. Publicly available exploit code exists, but no active exploitation has been confirmed.
A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041621c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_004137a4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc, week, sTime, eTime parameters in the function FUN_004133c4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the cloneMac parameter in the function FUN_0041af40. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN_00418540. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the command parameter in the function FUN_0041cc88. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00412ef4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_0041880c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the desc parameter in the function FUN_00413be4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLINK T6 V4.1.9cu.5179_B20201015 was discovered to contain a stack overflow via the password parameter in the function FUN_00413f80. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.