PT-2025-29473 · Totolink · Totolink T6

Elvisblue · Publicado 2025-07-13 · Atualizado 2025-07-17 · CVE-2025-7613

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748

Description: A critical issue exists in TOTOLINK T6 version 4.1.5cu.748. The vulnerability is located within the CloudSrvVersionCheck function of the /cgi-bin/cstecgi.cgi file, part of the HTTP POST Request Handler component. Manipulation of the ip argument allows for command injection. The attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations: TOTOLINK T6 version 4.1.5cu.748: As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation.

Exploit

Correção

Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-77

CWE-74

Identificadores relacionados

BDU:2025-10028

CVE-2025-7613

Produtos afetados

Totolink T6

Referências · 13

• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md · Exploit
• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md#poc · Exploit
• https://vuldb.com/?submit.615367 · Nota
• https://osv.dev/vulnerability/CVE-2025-7613 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-10028 · Nota de Segurança
• https://twitter.com/SecAideInfo/status/1945789873601822817 · Publicação no Twitter
• https://t.me/cvetracker/27789 · Publicação no Telegram
• https://totolink.net · Nota
• https://twitter.com/VulmonFeeds/status/1944813544362451355 · Publicação no Twitter
• https://vuldb.com/?ctiid.316313 · Nota
• https://twitter.com/CVEnew/status/1944779092814860652 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-7613 · Nota de Segurança
• https://vuldb.com/?id.316313 · Nota