CVE-2025-7613

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748

Description: A critical issue exists in TOTOLINK T6 version 4.1.5cu.748. The vulnerability is located within the CloudSrvVersionCheck function of the /cgi-bin/cstecgi.cgi file, part of the HTTP POST Request Handler component. Manipulation of the ip argument allows for command injection. The attack can be initiated remotely. The exploit has been publicly disclosed.

Recommendations: TOTOLINK T6 version 4.1.5cu.748: As a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation.