PT-2025-30164 · Totolink · Totolink T6

Reisen_1943 · Publicado 2025-07-17 · Atualizado 2025-08-04 · CVE-2025-7862

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015

Description A critical issue exists in the Telnet Service of TOTOLINK T6. The setTelnetCfg function within the /cgi-bin/cstecgi.cgi file is susceptible to missing authentication due to the manipulation of the telnet enabled argument with a value of 1. This allows for remote exploitation.

Recommendations TOTOLINK T6 version 4.1.5cu.748 B20211015: Disable the Telnet Service to prevent unauthorized access.

Exploit

Correção

RCE

Missing Authentication

Improper Authentication

Enumeração de Fraquezas

CWE-306

CWE-287

Identificadores relacionados

BDU:2025-08950

CVE-2025-7862

Produtos afetados

Totolink T6

Referências · 15

• 🔥 https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/5.md · Exploit
• 🔥 https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/5.md#poc-http · Exploit
• 🔥 https://youtube.com/watch?v=XeKu3tfeSME · Exploit
• https://osv.dev/vulnerability/CVE-2025-7862 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1946772889945899281 · Publicação no Twitter
• https://vuldb.com/?ctiid.316975 · Nota
• https://t.me/cvetracker/28238 · Publicação no Telegram
• https://vuldb.com/?id.316975 · Nota
• https://t.me/cvenotify/129575 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2025-08950 · Nota de Segurança
• https://twitter.com/jmdevlabs/status/1952365376106291644 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-7862 · Nota de Segurança
• https://vuldb.com/?submit.617643 · Nota
• https://twitter.com/VulmonFeeds/status/1946782614443974820 · Publicação no Twitter
• https://totolink.net · Nota