CVE-2025-7525
Published: 13 July 2025
Summary
CVE-2025-7525 is a low-severity Injection (CWE-74) vulnerability in Totolink T6 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability identified as CVE-2025-7525 exists in the TOTOLINK T6 router running firmware version 4.1.5cu.748_B20211015. It resides in the setTracerouteCfg function within the /cgi-bin/cstecgi.cgi file of the HTTP POST Request Handler component, where improper handling of the command argument permits command injection. The issue is tracked under CWE-74 and CWE-77 and carries a CVSS 4.0 score of 2.1 reflecting network attack vector, low attack complexity, and low-privileged access with limited impacts on confidentiality, integrity, and availability.
An authenticated remote attacker can send a crafted HTTP POST request to the affected endpoint and supply arbitrary commands through the manipulated argument. Successful exploitation grants the ability to execute operating-system commands on the device, potentially leading to limited unauthorized actions such as reading or modifying configuration data.
Public references consist of a GitHub repository containing a proof-of-concept and corresponding Vuldb entries that document the disclosure; no vendor advisory or patch information is included in the available references.
The exploit has been released publicly and the EPSS score remains flat at 0.0447 with no material increase observed after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21254
Vulnerability details
A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument command leads to command…
more
injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in router's public-facing web CGI (/cgi-bin/cstecgi.cgi#setTracerouteCfg) enables remote exploitation of public-facing application (T1190), Unix Shell execution (T1059.004), and indirect command execution via the handler (T1202).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the 'command' argument in HTTP POST requests to /cgi-bin/cstecgi.cgi, directly neutralizing special elements to prevent command injection.
Enforces restrictions on input types and formats for the 'command' parameter, limiting it to safe traceroute values and blocking arbitrary commands.
Directly remediates the command injection flaw in the setTracerouteCfg function by identifying, patching, and testing firmware updates.