CVE-2025-7758

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument ip leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-77598.8A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/j CVE-2025-77607.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ofisimo Web-Based Software Tech CVE-2025-77615.1Lepszy BIP is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in index.php form in one of the parameters allow CVE-2025-77626.5A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing o CVE-2025-77634.3A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the fil CVE-2025-77649.8A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. Affected is an unknown functio CVE-2025-77659.8A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is a CVE-2025-77668.0Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network devices, leading to u CVE-2025-77675.4A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue CVE-2025-77689.3Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative acces CVE-2025-77698.7Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is cal CVE-2025-77708.7Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predicta