PT-2025-30164 · Totolink · Totolink T6

Reisen_1943 · Published 2025-07-17 · Updated 2025-08-04 · CVE-2025-7862

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015

Description A critical issue exists in the Telnet Service of TOTOLINK T6. The setTelnetCfg function within the /cgi-bin/cstecgi.cgi file is susceptible to missing authentication due to the manipulation of the telnet enabled argument with a value of 1. This allows for remote exploitation.

Recommendations TOTOLINK T6 version 4.1.5cu.748 B20211015: Disable the Telnet Service to prevent unauthorized access.

Exploit

Fix

RCE

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BDU:2025-08950

CVE-2025-7862

Affected Products

Totolink T6

References · 15

• 🔥 https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/5.md · Exploit
• 🔥 https://github.com/AnduinBrian/Public/blob/main/Totolink%20T6/Vuln/5.md#poc-http · Exploit
• 🔥 https://youtube.com/watch?v=XeKu3tfeSME · Exploit
• https://osv.dev/vulnerability/CVE-2025-7862 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08950 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-7862 · Security Note
• https://twitter.com/CVEnew/status/1946772889945899281 · Twitter Post
• https://vuldb.com/?ctiid.316975 · Note
• https://t.me/cvetracker/28238 · Telegram Post
• https://vuldb.com/?id.316975 · Note
• https://t.me/cvenotify/129575 · Telegram Post
• https://twitter.com/jmdevlabs/status/1952365376106291644 · Twitter Post
• https://vuldb.com/?submit.617643 · Note
• https://twitter.com/VulmonFeeds/status/1946782614443974820 · Twitter Post
• https://totolink.net · Note