CVE-2025-7524
BaseFortify
Publication date: 2025-07-13
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totolink | t6_firmware | v4.1.5cu.748_b20211015 |
| totolink | t6 | 3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7524 is a critical command injection vulnerability in the TOTOLINK T6 router (version 4.1.5cu.748_B20211015). It exists in the HTTP POST request handler function setDiagnosisCfg in the file /cgi-bin/cstecgi.cgi. The vulnerability arises from improper handling of the 'ip' argument, allowing an attacker to inject arbitrary commands remotely by sending a crafted malicious POST request. This can lead to remote code execution on the device. [1, 2]
How can this vulnerability impact me? :
This vulnerability allows an attacker to remotely execute arbitrary commands on the affected TOTOLINK T6 router without authentication. This can compromise the confidentiality, integrity, and availability of the device and the network it is connected to. An attacker could take control of the router, disrupt network services, or use the device as a foothold for further attacks. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests to the endpoint /cgi-bin/cstecgi.cgi with the parameter setDiagnosisCfg containing manipulated 'ip' arguments that may include command injection payloads. Network intrusion detection systems (NIDS) can be configured to look for unusual POST requests targeting this endpoint. Additionally, you can use tools like curl or wget to test the endpoint manually by sending crafted POST requests to see if the device responds unexpectedly or executes commands. For example, a command to test might be: curl -X POST http://<router-ip>/cgi-bin/cstecgi.cgi -d 'setDiagnosisCfg=ip=;id' to check if command injection is possible. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include discontinuing use of the affected TOTOLINK T6 router version 4.1.5cu.748_B20211015, as no known mitigations or patches are available. It is recommended to replace the affected device with an alternative product. Additionally, restrict network access to the router's management interface to trusted hosts only, and monitor for suspicious activity targeting the /cgi-bin/cstecgi.cgi endpoint. Applying network-level protections such as firewall rules to block unauthorized POST requests to this endpoint can also help reduce risk. [2]