CVE-2025-7614

TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injection

State: Published
Severity: 5.3 Medium
Published: Jul 14, 2025
Updated: Jul 15, 2025
Reserved: Jul 13, 2025

Description

A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-77 Command Injection
CWE-74 Injection

Affected Products

Product	Versions
T6TOTOLINK	4.1.5cu.748Affected

References

VDB-316314 | TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injectionvdb-entrytechnical-description
VDB-316314 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #615368 | TOTOLINK T6 V4.1.5cu.748 Command Injectionthird-party-advisory
https://github.com/ElvisBlue/Public/blob/main/Vuln/5.mdrelated
https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md#pocexploit
https://www.totolink.net/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.