CVE-2025-7615
Published: 14 July 2025
Summary
CVE-2025-7615 is a medium-severity Injection (CWE-74) vulnerability in Totolink T6 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of the manipulated 'ip' argument in HTTP POST requests to the clearPairCfg function, directly preventing command injection exploits.
Mandates timely identification, reporting, and correction of the command injection flaw in TOTOLINK T6 firmware version 4.1.5cu.748.
Enforces restrictions on inputs to the HTTP POST handler, limiting the 'ip' parameter to valid formats and blocking injection payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via unauthenticated HTTP POST to router's web CGI enables exploitation of public-facing application (T1190), indirect command execution (T1202), and network device CLI abuse (T1059.008).
NVD Description
A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection.…
more
The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Deeper analysisAI
CVE-2025-7615 is a command injection vulnerability classified as critical in the TOTOLINK T6 router running firmware version 4.1.5cu.748. The issue affects the clearPairCfg function within the /cgi-bin/cstecgi.cgi component, part of the HTTP POST Request Handler. By manipulating the 'ip' argument in a crafted request, an attacker can inject arbitrary commands, as mapped to CWE-74 (Improper Neutralization of Special Elements used in an OS Command) and CWE-77 (Command Injection). The vulnerability carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability enables remote exploitation over the network with low complexity and no user interaction required. Attackers need low privileges (PR:L), such as those obtainable through existing access like a standard user account on the device. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, potentially enabling arbitrary command execution on the underlying system.
Advisories from VulDB and a public GitHub repository document the vulnerability, including a proof-of-concept exploit available at https://github.com/ElvisBlue/Public/blob/main/Vuln/6.md and https://github.com/ElvisBlue/Public/blob/main/Vuln/6.md#poc. No patches or specific mitigation steps from the vendor are detailed in the available references.
The exploit has been publicly disclosed, increasing the risk of widespread abuse against unpatched TOTOLINK T6 devices.
Details
- CWE(s)