Totolink t6 Firmware vulnerabilities

39 CVEs affecting Totolink t6 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-8170, published 2025-07-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-25084, published 2022-02-24. Critical severity, CVSS 9.8. EPSS: 21.8% chance of exploitation in the next 30 days. TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the…
CVE-2025-7952, published 2025-07-22. High severity, CVSS 8.8. EPSS: 21.3% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of the component MQTT Packet Handler. The…
CVE-2022-38828, published 2022-09-16. Critical severity, CVSS 9.8. EPSS: 20.1% chance of exploitation in the next 30 days. TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi
CVE-2022-38827, published 2022-09-16. Critical severity, CVSS 9.8. EPSS: 12.5% chance of exploitation in the next 30 days. TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi
CVE-2022-25134, published 2022-02-19. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted…
CVE-2022-25135, published 2022-02-19. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a…
CVE-2022-25133, published 2022-02-19. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a…
CVE-2022-25132, published 2022-02-19. Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days. A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted…
CVE-2025-7525, published 2025-07-13. High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi of the…
CVE-2025-7524, published 2025-07-13. High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015. It has been classified as critical. This affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP…

Latest

CVE-2025-8170, published 2025-07-25. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router/meshSlaveDlfw of the component MQTT…
CVE-2025-7913, published 2025-07-21. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. Affected is the function updateWifiInfo of the component MQTT Service. The manipulation of the…
CVE-2025-7912, published 2025-07-20. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in TOTOLINK T6 4.1.5cu.748_B20211015. This issue affects the function recvSlaveUpgstatus of the component MQTT Service. The…
CVE-2025-7862, published 2025-07-20. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the…
CVE-2025-7837, published 2025-07-19. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this issue is the function recvSlaveStaInfo of the component MQTT Service. The manipulation of…
CVE-2025-7758, published 2025-07-17. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi…
CVE-2025-7615, published 2025-07-14. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. Affected by this vulnerability is the function clearPairCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST…
CVE-2025-7614, published 2025-07-14. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability classified as critical has been found in TOTOLINK T6 4.1.5cu.748. Affected is the function delDevice of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The…
CVE-2025-7613, published 2025-07-14. High severity, CVSS 8.8. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability was found in TOTOLINK T6 4.1.5cu.748. It has been rated as critical. This issue affects the function CloudSrvVersionCheck of the file /cgi-bin/cstecgi.cgi of the component HTTP POST…