Cyber Resilience

CVE-2025-7154

LowPublic PoC

Published: 08 July 2025

Published
08 July 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score v4 2.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0571 90.6th percentile
Risk Priority 8 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7154 is a low-severity Command Injection (CWE-77) vulnerability in Totolink N200Re Firmware. Its CVSS base score is 2.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A critical OS command injection vulnerability, tracked as CVE-2025-7154 and assigned CWE-77 and CWE-78, affects the TOTOLINK N200RE router running firmware versions 9.3.5u.6095_B20200916 and 9.3.5u.6139_B20201216. The flaw exists in the sub_41A0F8 function of /cgi-bin/cstecgi.cgi, where unsanitized input supplied to the Hostname argument is passed to the operating system without proper validation.

An authenticated remote attacker can supply a malicious Hostname value via crafted HTTP requests to the device's web management interface, resulting in arbitrary command execution on the device. The CVSS 4.0 vector indicates network attack reachability with low attack complexity and low privileges required, though the resulting impact on confidentiality, integrity, and availability remains limited.

Public exploit code has been disclosed on GitHub, and the EPSS score has remained flat at 0.0571 with no material increase since publication. Vendor references point to the TOTOLINK support site, but no specific patch or mitigation guidance is detailed in the available advisories.

EU & UK References

Vulnerability details

A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216. Affected by this issue is the function sub_41A0F8 of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Hostname leads to os command injection. The attack may…

more

be launched remotely. The exploit has been disclosed to the public and may be used.

CWE(s)
CWE-77CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
Why these techniques?

OS command injection via remote web CGI (Hostname parameter) enables exploitation of public-facing application (T1190), indirect command execution (T1202), and Unix shell command execution (T1059.004).

Affected Assets

totolink
n200re firmware
9.3.5u.6095_b20200916, 9.3.5u.6139_b20201216

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References