CVE-2025-6916

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in TOTOLINK T6 4.1.5cu.748_B20211015. This affects the function Form_Login of the file /formLoginAuth.htm. The manipulation of the argument authCode/goURL leads to missing authentication. The attack needs to be initiated within the local network. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Jun 30, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-691608.1Unauthenticated Local File Inclusion in Gita <= 1.11 versions.CVE-2025-691618.1Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.CVE-2025-691628.1Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.CVE-2025-691638.1Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.CVE-2025-691648.1Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.CVE-2025-691658.1Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.CVE-2025-691668.1Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.CVE-2025-691678.1Unauthenticated Local File Inclusion in Eros <= 1.3 versions.CVE-2025-691688.1Unauthenticated Local File Inclusion in Spike <= 1.2 versions.CVE-2025-691695.4Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-downCVE-2025-69179.8A vulnerability has been found in code-projects Online Hotel Booking 1.0 and classified as critical. This vulnerability affects unknown codeCVE-2025-691708.1Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
CVE-2025-6916: High severity, CVSS 8.8 | Vulnix