CVE-2025-7614: TOTOLINK T6 HTTP POST Request cstecgi.cgi delDevice command injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-14 · updated 2026-06-17
Weakness: CWE-74

Description

A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

TOTOLINK T6: v4.1.5cu.748_b20211015

References

https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md
https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md#poc
https://vuldb.com/?ctiid.316314
https://vuldb.com/?id.316314
https://vuldb.com/?submit.615368
https://www.totolink.net/
https://github.com/ElvisBlue/Public/blob/main/Vuln/5.md

Get alerted when CVE-2025-7614 or the next vulnerability affects your stack