CVE-2025-7614
Published: 14 July 2025
Summary
CVE-2025-7614 is a low-severity Injection (CWE-74) vulnerability in Totolink T6 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A critical command injection vulnerability has been found in TOTOLINK T6 version 4.1.5cu.748. It resides in the delDevice function of the /cgi-bin/cstecgi.cgi file within the HTTP POST Request Handler component, where manipulation of the ipAddr argument allows arbitrary command execution. The flaw is tracked as CVE-2025-7614 and mapped to CWE-74 and CWE-77.
Remote attackers with low privileges can exploit the issue over the network by submitting specially crafted HTTP POST requests, resulting in limited impacts to confidentiality, integrity, and availability according to the provided CVSS 4.0 vector. The attack does not require user interaction and can be launched without physical access to the device.
Public references including a GitHub disclosure and corresponding Vuldb entries confirm that a proof-of-concept exploit has been released, though no official vendor advisory or patch information is referenced. The EPSS score has remained flat at 0.0455 with no material rise observed since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21358
Vulnerability details
A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is…
more
possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remotely exploitable command injection in a public-facing web CGI endpoint (/cgi-bin/cstecgi.cgi delDevice ipAddr) on a router, enabling exploitation of public-facing applications (T1190) and indirect command execution (T1202) as explicitly mapped in advisories.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by validating the ipAddr argument in HTTP POST requests to /cgi-bin/cstecgi.cgi to ensure it contains only legitimate IP address values without shell metacharacters.
Remediates the specific command injection flaw in the delDevice function by identifying, patching firmware, or implementing workarounds promptly after disclosure.
Enforces least privilege on the HTTP POST handler process to restrict the scope and impact of any successfully injected commands executed by an authenticated low-privilege attacker.