CVE-2025-4850

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in TOTOLINK N300RH 6.1c.1390_B20191101. This affects the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument plugin_name leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-77

Affected software

No affected versions have been published.

Timeline

Published
May 18, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-485007.3A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker CVE-2025-485019.3An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4. If this vulnerability is exploited, an arbitrary OS commanCVE-2025-485025.5Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial oCVE-2025-485037.8A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting inCVE-2025-485051.0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to achieve privileged eCVE-2025-485064.6Uncontrolled search paths in Vitis™ Unified installation path on local Windows machines could allow DLL injection into these install paths, CVE-2025-485078.6The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors accesCVE-2025-485086.0Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control CVE-2025-485091.8Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of CVE-2025-48519.8A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUsCVE-2025-485107.1Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availaCVE-2025-485115.5Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in cr
CVE-2025-4850: Medium severity, CVSS 6.3 | Vulnix