CVE-2025-7524
Published: 13 July 2025
Summary
CVE-2025-7524 is a low-severity Injection (CWE-74) vulnerability in Totolink T6 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A command injection vulnerability tracked as CVE-2025-7524 affects the TOTOLINK T6 router running firmware 4.1.5cu.748_B20211015. The flaw exists in the setDiagnosisCfg function of the /cgi-bin/cstecgi.cgi endpoint inside the HTTP POST Request Handler, where unsanitized input to the ip parameter is passed to an operating-system command.
An authenticated remote attacker can supply a malicious ip value in a crafted POST request to execute arbitrary commands on the device. The CVSS 4.0 vector indicates network access with low attack complexity and low privileges, resulting in limited effects on confidentiality, integrity, and availability.
Public proof-of-concept code has been published on GitHub, and the EPSS score remains flat at 0.0447 with no material increase since disclosure. No vendor advisory or patch information is referenced in the available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21252
Vulnerability details
A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection.…
more
It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing router web CGI (/cgi-bin/cstecgi.cgi) enables exploitation of public-facing applications (T1190) and arbitrary Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates and sanitizes the 'ip' argument in HTTP POST requests to the setDiagnosisCfg function in /cgi-bin/cstecgi.cgi to directly prevent command injection exploits.
Identifies, reports, and remediates the specific command injection flaw in TOTOLINK T6 firmware version 4.1.5cu.748_B20211015 through timely patching or updates.
Enforces least privilege on the HTTP POST handler process and any executed commands to limit the scope and impact of successful command injection by low-privilege (PR:L) attackers.