CVE-2025-9935

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
TOTOLINK	N600R	4.3.0cu.7866_B20220506

References

https://github.com/mono7s/TOTOLINK/blob/main/N600R/TOTOLINK%20N600R%20Unauthorized_Command_Injection.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.322337Permissions Required, VDB Entry
https://vuldb.com/?id.322337Third Party Advisory, VDB Entry
https://vuldb.com/?submit.643088Third Party Advisory, VDB Entry
https://www.totolink.net/Product

Timeline

Published: Sep 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-99364.3A vulnerability was identified in fuyang_lipengjun platform 1.0.0. This issue affects the function AdController of the file /ad/queryAll. Th CVE-2025-99375.4A security flaw has been discovered in elunez eladmin 1.1. Impacted is the function deleteFile of the component LocalStorageController. The CVE-2025-99388.8A weakness has been identified in D-Link DI-8400 16.07.26A1. The affected element is the function yyxz_dlink_asp of the file /yyxz.asp. This CVE-2025-99395.4A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of th CVE-2025-99405.4A vulnerability was detected in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /feature.php. Perf CVE-2025-99418.8A flaw has been found in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /register.php. Executing CVE-2025-99428.8A vulnerability has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /submitproperty.p CVE-2025-99439.1An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Servic CVE-2025-99444.3The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. CVE-2025-99454.3The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This CVE-2025-99466.1The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl CVE-2025-99474.9The Custom 404 Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘path’ parameter in all versions up to, and includ