CVE-2025-4851

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in TOTOLINK N300RH 6.1c.1390_B20191101. This vulnerability affects the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: May 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-485107.1Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availa CVE-2025-485115.5Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potentially resulting in cr CVE-2025-485127.0Incorrect default permissions in the installation directory for the AMD general-purpose input/output controller (GPIO) could allow an attack CVE-2025-485136.9Use of uninitialized resource within the AMD Platform Management Framework (PMF) could allow an attacker to read a uninitialized kernel memo CVE-2025-485144.0Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, pot CVE-2025-485155.4Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overw CVE-2025-485166.9Insecure default configuration state of DDR5 memory module by AGESA Bootloader Firmware could allow an attacker with local user privilege to CVE-2025-485174.6Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES gues CVE-2025-485186.9Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integ CVE-2025-485198.5An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read or w CVE-2025-48523.4A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknow CVE-2025-485206.9An improper input validation vulnerability within the AMD Platform Management Framework (PMF) driver can allow a local attacker to read Out-