Totolink T6 Firmware vulnerabilities

CVE-2025-8170 [HIGH] CWE-119 CVE-2025-8170: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerab A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT Packet Handler. The manipulation of the argument serverIp leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the

CVE-2025-7952 [MEDIUM] CWE-74 CVE-2025-7952: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affe A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7913 [HIGH] CWE-119 CVE-2025-7913: A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. A A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the argument serverIp leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7912 [HIGH] CWE-119 CVE-2025-7912: A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B202110 A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The manipulation of the argument s leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7862 [MEDIUM] CWE-287 CVE-2025-7862: A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affe A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component Telnet Service. The manipulation of the argument telnet_enabled with the input 1 leads to missing authentication. The attack can be launched remote

CVE-2025-7837 [HIGH] CWE-119 CVE-2025-7837: A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the component MQTT Service. The manipulation of the argument dest leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2025-7758 [HIGH] CWE-119 CVE-2025-7758: A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit ha

CVE-2025-7615 [MEDIUM] CWE-74 CVE-2025-7615: A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulner A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the p

CVE-2025-7613 [MEDIUM] CWE-74 CVE-2025-7613: A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affe A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the

CVE-2025-7614 [MEDIUM] CWE-74 CVE-2025-7614: A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the fu A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ipAddr leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public a

CVE-2025-7525 [MEDIUM] CWE-74 CVE-2025-7525: A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. Th A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument command leads to command injection. The attack can be initiated remotely. The exploit has

CVE-2025-7524 [MEDIUM] CWE-74 CVE-2025-7524: A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been dis

CVE-2025-7460 [HIGH] CWE-119 CVE-2025-7460: A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affe A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads to buffer overflow. The attack can be launched remotely. The exploit has bee

CVE-2025-6916 [HIGH] CWE-287 CVE-2025-6916: A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. T A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public an

CVE-2023-7221 [CRITICAL] CWE-120 CVE-2023-7221: A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. A vulnerability was found in Totolink T6 4.1.9cu.5241_B20210923. It has been classified as critical. This affects the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument v41 leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has be

CVE-2023-7223 [MEDIUM] CWE-284 CVE-2023-7223: A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This A vulnerability classified as problematic has been found in Totolink T6 4.1.9cu.5241_B20210923. This affects an unknown part of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument topicurl with the input showSyslog leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi

CVE-2022-38823 [CRITICAL] CWE-798 CVE-2022-38823: In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.

CVE-2022-38827 [CRITICAL] CWE-120 CVE-2022-38827: TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi

CVE-2022-38826 [CRITICAL] CWE-78 CVE-2022-38826: In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.

CVE-2022-38828 [CRITICAL] CWE-78 CVE-2022-38828: TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi