PT-2025-29366 · Totolink · Totolink T6

Elvisblue · Publicado 2025-07-09 · Atualizado 2025-07-15 · CVE-2025-7524

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015

Description A critical vulnerability exists in the TOTOLINK T6 router. The issue is a command injection vulnerability located in the setDiagnosisCfg function within the /cgi-bin/cstecgi.cgi file of the HTTP POST Request Handler component. Manipulation of the ip argument allows for remote command execution. The exploit for this vulnerability has been publicly disclosed.

Recommendations TOTOLINK T6 version 4.1.5cu.748 B20211015: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

BDU:2025-08498

CVE-2025-7524

Produtos afetados

Totolink T6

Referências · 15

• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/2.md · Exploit
• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/2.md#poc · Exploit
• 🔥 https://youtube.com/watch?v=T62BuSoHmoM · Exploit
• https://bdu.fstec.ru/vul/2025-08498 · Nota de Segurança
• https://vuldb.com/?id.316221 · Nota
• https://twitter.com/VulmonFeeds/status/1944326997657677885 · Publicação no Twitter
• https://vuldb.com/?ctiid.316221 · Nota
• https://t.me/cvetracker/27677 · Publicação no Telegram
• https://twitter.com/SecAideInfo/status/1945064936075616766 · Publicação no Twitter
• https://t.me/cvenotify/128738 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-7524 · Aviso do Fabricante
• https://totolink.net · Nota
• https://vuldb.com/?submit.612935 · Nota
• https://twitter.com/CVEnew/status/1944331656921579909 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-7524 · Nota de Segurança