CVE-2025-7614
TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injection
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 5.3EPSS 2.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
14 jul 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
TOTOLINK · T6Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →