CVE-2025-4850

CWE-74CWE-77 — Command Injection3 documents3 sources
Severity
5.3MEDIUM
EPSS
1.4%
top 19.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Totolink N300rhTotolink N300rh Firmware
Timeline
PublishedMay 18

Description

A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5totolink/n300rh6.1c.1390_B20191101
▶NVDtotolink/n300rh_firmware6.1c.1390_b20191101

🔴Vulnerability Details

2
GHSA
GHSA-j68f-x23w-cvmr: A vulnerability classified as critical has been found in TOTOLINK N300RH 6↗2025-05-18
▶
CVEList
TOTOLINK N300RH cstecgi.cgi setUnloadUserData command injection↗2025-05-18
▶
CVE-2025-4850 (MEDIUM CVSS 5.3) | A vulnerability classified as criti | cvebase.io