PT-2025-29473 · Totolink · Totolink T6

Elvisblue · Published 2025-07-13 · Updated 2025-07-17 · CVE-2025-7613

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748

Description: A critical issue exists in TOTOLINK T6 version 4.1.5cu.748. The vulnerability is located within the CloudSrvVersionCheck function of the /cgi-bin/cstecgi.cgi file, part of the HTTP POST Request Handler component. Manipulation of the ip argument allows for command injection. The attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations: TOTOLINK T6 version 4.1.5cu.748: As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Special Elements Injection

Weakness Enumeration

CWE-77

CWE-74

Related Identifiers

BDU:2025-10028

CVE-2025-7613

Affected Products

Totolink T6

References · 13

• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md · Exploit
• 🔥 https://github.com/ElvisBlue/Public/blob/main/Vuln/4.md#poc · Exploit
• https://osv.dev/vulnerability/CVE-2025-7613 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10028 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7613 · Security Note
• https://vuldb.com/?submit.615367 · Note
• https://twitter.com/SecAideInfo/status/1945789873601822817 · Twitter Post
• https://t.me/cvetracker/27789 · Telegram Post
• https://totolink.net · Note
• https://twitter.com/VulmonFeeds/status/1944813544362451355 · Twitter Post
• https://vuldb.com/?ctiid.316313 · Note
• https://twitter.com/CVEnew/status/1944779092814860652 · Twitter Post
• https://vuldb.com/?id.316313 · Note