CVE-2025-7615
Published: 14 July 2025
Summary
CVE-2025-7615 is a low-severity Injection (CWE-74) vulnerability in Totolink T6 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 10.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-7615 is a command injection vulnerability in the TOTOLINK T6 router running firmware 4.1.5cu.748. It resides in the clearPairCfg function of the /cgi-bin/cstecgi.cgi component that handles HTTP POST requests, where unsanitized input to the ip argument is passed to an operating system command.
An authenticated remote attacker can supply a crafted ip value in a POST request to execute arbitrary commands on the device. The CVSS 4.0 vector reflects network attack reachability with low attack complexity and low-privileged access, resulting in limited impacts to confidentiality, integrity, and availability on the affected host.
Public proof-of-concept code has been published on GitHub and referenced in Vuldb entries, confirming that the exploit is already available. The associated EPSS score remains flat at 0.0455 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21356
Vulnerability details
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection.…
more
The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via unauthenticated HTTP POST to router's web CGI enables exploitation of public-facing application (T1190), indirect command execution (T1202), and network device CLI abuse (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the manipulated 'ip' argument in HTTP POST requests to the clearPairCfg function, directly preventing command injection exploits.
Mandates timely identification, reporting, and correction of the command injection flaw in TOTOLINK T6 firmware version 4.1.5cu.748.
Enforces restrictions on inputs to the HTTP POST handler, limiting the 'ip' parameter to valid formats and blocking injection payloads.