CVE-2025-7613: falha de média gravidade em TOTOLINK T6
TOTOLINK T6 HTTP POST Request cstecgi.cgi CloudSrvVersionCheck command injection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 2.4%
A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
TOTOLINK · T6CVEs relacionadas — TOTOLINK T6
No mesmo produto, das mais perigosas para as menos.
CVE-2025-7952MEDIUMTOTOLINK T6 MQTT Packet wireless.so ckeckKeepAlive command injectionEPSS 24.5%CVE-2025-7525MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi setTracerouteCfg command injectionEPSS 2.8%CVE-2025-7524MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi setDiagnosisCfg command injectionEPSS 2.8%CVE-2025-7615MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi clearPairCfg command injectionEPSS 2.4%CVE-2025-7614MEDIUMTOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injectionEPSS 2.4%CVE-2025-8170HIGHTOTOLINK T6 MQTT Packet meshSlaveDlfw tcpcheck_net buffer overflowEPSS 1.3%