Totolink T6 Firmware vulnerabilities

CVE-2022-25084 [CRITICAL] CWE-78 CVE-2022-25084: TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

CVE-2022-25134 [CRITICAL] CWE-77 CVE-2022-25134: A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_F A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVE-2025-7952 [HIGH] CWE-74 CVE-2025-7952: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affe A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2022-38828 [CRITICAL] CWE-78 CVE-2022-38828: TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi

CVE-2025-7525 [HIGH] CWE-74 CVE-2025-7525: A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. Th A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument command leads to command injection. The attack can be initiated remotely. The exploit has b

CVE-2025-7524 [HIGH] CWE-74 CVE-2025-7524: A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been discl

CVE-2025-7615 [HIGH] CWE-74 CVE-2025-7615: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulner A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the pub

CVE-2025-7613 [HIGH] CWE-74 CVE-2025-7613: A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affe A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the p

CVE-2025-7614 [HIGH] CWE-74 CVE-2025-7614: A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the fu A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and

CVE-2025-7862 [CRITICAL] CWE-287 CVE-2025-7862: A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affe A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to missing authentication. The attack can be launched remo

CVE-2022-25135 [CRITICAL] CWE-77 CVE-2022-25135: A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVE-2022-25132 [CRITICAL] CWE-77 CVE-2022-25132: A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_ A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVE-2022-25133 [CRITICAL] CWE-77 CVE-2022-25133: A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVE-2023-7221 [CRITICAL] CWE-120 CVE-2023-7221: A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has be

CVE-2025-7758 [HIGH] CWE-119 CVE-2025-7758: A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit ha

CVE-2025-7460 [HIGH] CWE-119 CVE-2025-7460: A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affe A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be launched remotely. The exploit has bee

CVE-2022-25137 [CRITICAL] CWE-77 CVE-2022-25137: A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVE-2022-25130 [CRITICAL] CWE-77 CVE-2022-25130: A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVE-2022-25131 [CRITICAL] CWE-77 CVE-2022-25131: A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology r A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.

CVE-2022-25136 [CRITICAL] CWE-77 CVE-2022-25136: A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.