CVE-2025-7154: TOTOLINK N200RE cstecgi.cgi sub_41A0F8 os command injection
A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095B20200916/9.3.5u.6139B20201216. Affected by this issue is the function sub41A0F8 of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Hostname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7154?
CVE-2025-7154 is classified as a critical vulnerability.
How do I fix CVE-2025-7154?
To fix CVE-2025-7154, update the TOTOLINK N200RE firmware to the latest version provided by the vendor.
What type of attack does CVE-2025-7154 enable?
CVE-2025-7154 enables OS command injection attacks via the Hostname parameter.
Which devices are affected by CVE-2025-7154?
CVE-2025-7154 affects the TOTOLINK N200RE devices running versions between 9.3.5u.6095_B20200916 and 9.3.5u.6139_B20201216.
How can I confirm if my device is vulnerable to CVE-2025-7154?
You can confirm if your device is vulnerable to CVE-2025-7154 by checking the firmware version against the affected versions listed.