PT-2025-29366 · Totolink · Totolink T6

Elvisblue · Published 2025-07-09 · Updated 2025-07-15 · CVE-2025-7524

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015

Description A critical vulnerability exists in the TOTOLINK T6 router. The issue is a command injection vulnerability located in the setDiagnosisCfg function within the /cgi-bin/cstecgi.cgi file of the HTTP POST Request Handler component. Manipulation of the ip argument allows for remote command execution. The exploit for this vulnerability has been publicly disclosed.

Recommendations TOTOLINK T6 version 4.1.5cu.748 B20211015: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

BDU:2025-08498

CVE-2025-7524

Affected Products

Totolink T6

References · 15

• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/2.md · Exploit
• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/2.md#poc · Exploit
• 🔥 https://youtube.com/watch?v=T62BuSoHmoM · Exploit
• https://bdu.fstec.ru/vul/2025-08498 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7524 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7524 · Security Note
• https://vuldb.com/?id.316221 · Note
• https://twitter.com/VulmonFeeds/status/1944326997657677885 · Twitter Post
• https://vuldb.com/?ctiid.316221 · Note
• https://t.me/cvetracker/27677 · Telegram Post
• https://twitter.com/SecAideInfo/status/1945064936075616766 · Twitter Post
• https://t.me/cvenotify/128738 · Telegram Post
• https://totolink.net · Note
• https://vuldb.com/?submit.612935 · Note
• https://twitter.com/CVEnew/status/1944331656921579909 · Twitter Post