CVE-2025-52089
Published: 11 July 2025
Summary
CVE-2025-52089 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Totolink N300Rb Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and IA-5 (Authenticator Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
CM-7 Least Functionality prohibits or restricts unnecessary functions such as hidden remote support features, directly preventing their availability for exploitation.
MA-4 Nonlocal Maintenance requires approval, management, and policy-compliant use of remote diagnostic tools, mitigating hidden remote support interfaces.
IA-5 Authenticator Management prohibits static secrets and enforces proper handling of authenticators protecting critical functions like remote command execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in hidden remote support feature (static secret, missing auth per CWE-306) directly enables unauthenticated RCE as root on adjacent network, mapping to public-facing app exploitation and Unix shell command execution.
NVD Description
A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges.
Deeper analysisAI
CVE-2025-52089 affects the TOTOLINK N300RB firmware version 8.54 and involves a hidden remote support feature protected solely by a static secret. This flaw enables an authenticated attacker to execute arbitrary OS commands with root privileges. Published on 2025-07-11, the vulnerability carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-306 (Missing Authentication for Critical Function).
Attackers positioned on the adjacent network can exploit this with low complexity and no prior privileges or user interaction required. Successful exploitation grants remote code execution as root, resulting in high impacts to confidentiality, integrity, and availability on the targeted device.
Mitigation details are available in the referenced advisory at https://0x09.dev/posts/toto_decouvre_une_interface_de_debug/.
Details
- CWE(s)