CVE-2025-6916: TOTOLINK T6 formLoginAuth.htm Form_Login missing authentication
A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748B20211015. This affects the function FormLogin of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6916?
CVE-2025-6916 is classified as a critical vulnerability.
How do I fix CVE-2025-6916?
To fix CVE-2025-6916, update the TOTOLINK T6 to the latest version provided by the manufacturer.
What specific function is affected by CVE-2025-6916?
The vulnerability affects the Form_Login function in the /formLoginAuth.htm file.
What kind of attack can exploit CVE-2025-6916?
CVE-2025-6916 can be exploited through missing authentication by manipulating the authCode/goURL arguments.
Which devices are affected by CVE-2025-6916?
The affected device for CVE-2025-6916 is the TOTOLINK T6.