CVE-2025-51390
Published: 04 August 2025
Summary
CVE-2025-51390 is a critical-severity OS Command Injection (CWE-78) vulnerability in Totolink N600R Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection by enforcing validation of the untrusted pin parameter in the setWiFiWpsConfig function.
Remediates the specific command injection flaw through timely identification, reporting, and patching of the vulnerable firmware.
Mitigates exposure by disabling or restricting the non-essential WPS configuration functionality that hosts the vulnerable endpoint.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via web interface parameter enables exploitation of public-facing application (T1190) and arbitrary command execution on network device CLI (T1059.008).
NVD Description
TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function.
Deeper analysisAI
CVE-2025-51390 is a command injection vulnerability (CWE-78) affecting the TOTOLINK N600R router running firmware version V4.3.0cu.7647_B20210106. The issue resides in the setWiFiWpsConfig function, where the pin parameter allows injection of arbitrary commands.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low attack complexity, requiring no authentication, privileges, or user interaction. Successful exploitation enables unauthenticated attackers to execute arbitrary commands on the device, potentially resulting in high-impact compromise of confidentiality, integrity, and availability, such as full router takeover.
Advisories and additional technical details, including potential proof-of-concept information, are referenced at http://totolink.com and GitHub locations such as https://github.com/Luanruy/qianxin/blob/main/CVE-2025-51390.md, https://github.com/Luanruy/qianxin/blob/main/overflow-0x41ca08.md, and https://github.com/Luanruy/qianxin/blob/main/CVE-2025-51390.md. The CVE was published on 2025-08-04T18:15:34.927.
Details
- CWE(s)